DllCanUnloadNow
DllUnregisterServer
Behavioral task
behavioral1
Sample
69c545c36eb951e9c5723bad0088bbe1_JaffaCakes118.dll
Resource
win7-20240708-en
Target
69c545c36eb951e9c5723bad0088bbe1_JaffaCakes118
Size
24KB
MD5
69c545c36eb951e9c5723bad0088bbe1
SHA1
db4947e6706061267b72654f8e7cbbe5fdd59c89
SHA256
520e8d34813d113630f044dbb6ac20f8ec2382427db273cc07338c5781b3338c
SHA512
a5da5d027457d32816536949730cd5d7a31b8aa2bcac6833420fc53530ea7420ed01e3e73b846c45b9b068880dae043ad5b6c431c30894e0342f2a9c73177de4
SSDEEP
384:RTdCgJ3UV3yzKjxqd8ZwqOKxTfdPEZswSi77+CS3r9IY0:RTdCF3yuqd8ZJOKx03mb9Ij
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
69c545c36eb951e9c5723bad0088bbe1_JaffaCakes118 |
unpack001/out.upx |
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ