?ExtractServices@@YAHPAD@Z
?InitSQLConnectOff@@YAHPAD@Z
InitSQLConnect
SQLAlloc
SQLClose
SQLExecute
SQLFree
SQLQuery
Uninstall
Behavioral task
behavioral1
Sample
708cc04b17294dd1cc754730efe57557_JaffaCakes118.dll
Resource
win7-20240708-en
Target
708cc04b17294dd1cc754730efe57557_JaffaCakes118
Size
31KB
MD5
708cc04b17294dd1cc754730efe57557
SHA1
2c7383746fa1726fb91862d9a53c6ee32ccc03af
SHA256
f67753be7bb0850b76a6dac24d55aae4781d5312070e10c0d6a92657162ff6ce
SHA512
ffbe1dfae49b937b9eef15c76d8f3ba7b5ba719ef9e593b86db366066ad617088daabc65e25345cea40c2fb6660bf3675aea2d08ee6eb03a3fa82c5ce65ce7f3
SSDEEP
768:fAMT9SayqwOgt1vKr3SeOJa1RTtn5IXVlmLeHdM96mV:fAM2qx0Wya1RTt5i80pm
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
708cc04b17294dd1cc754730efe57557_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
?ExtractServices@@YAHPAD@Z
?InitSQLConnectOff@@YAHPAD@Z
InitSQLConnect
SQLAlloc
SQLClose
SQLExecute
SQLFree
SQLQuery
Uninstall
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ