DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
69adb2ee98bf504d51483076b9b855a0_JaffaCakes118.dll
Resource
win7-20240705-en
Target
69adb2ee98bf504d51483076b9b855a0_JaffaCakes118
Size
67KB
MD5
69adb2ee98bf504d51483076b9b855a0
SHA1
f83ab67d89cfd0696e720f5c74355d44f950cca9
SHA256
880b3a03172aa67f8555da0ccf7ff8242c084eeb1845af42ae2c045ba3f7416e
SHA512
3e412e322c297657def9db368ef378419a96cac528e4e71e23f02ca42497bb0d70181f4a4dfe413fcc547a49bd44aa1a0e55cfdd8ce40e2b47a7f80ca7e8d6a2
SSDEEP
1536:43F92+fTOsEiitVrvZlgj6kZRgVV+Blz02u+HOST:4qPsEBf7rEJZRgV4xuMf
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
69adb2ee98bf504d51483076b9b855a0_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ