DllCanUnloadNow
DllGetClassObject
HandlerEx
Inst
ServiceMain
Behavioral task
behavioral1
Sample
749d868b8901c5449b83ee14c9940314_JaffaCakes118.dll
Resource
win7-20240708-en
Target
749d868b8901c5449b83ee14c9940314_JaffaCakes118
Size
60KB
MD5
749d868b8901c5449b83ee14c9940314
SHA1
35c5cd90372643e97489a063f34edfd20daafc2e
SHA256
3496409da32291250e5e6cefd971193ea381184c67cd9a0a80ddf5c7399391b2
SHA512
0793bd946bbad1811cfb2ef599cea7b127b528cf699ae1a5ecad3221bca1cb37f105194b012900d444524a1cf7693ce7e0a0510f448bbaf332d41db92b799bcd
SSDEEP
1536:qXjhGbKRGeCoo1CcGNNDwxKWc+KptN/OZI+5cO2A:K8MXC0NNqsPBWZxj2A
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
749d868b8901c5449b83ee14c9940314_JaffaCakes118 |
unpack001/out.upx |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
HandlerEx
Inst
ServiceMain
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ