DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
74c154ba48ddfe4aa1d0d660e58fd0cb_JaffaCakes118.dll
Resource
win7-20240704-en
Target
74c154ba48ddfe4aa1d0d660e58fd0cb_JaffaCakes118
Size
45KB
MD5
74c154ba48ddfe4aa1d0d660e58fd0cb
SHA1
474375d7708bb2e20ff0a8fcdb64e7edf255eed8
SHA256
f2017c4b4f302fedce1cce2206a3df187c03550e1df6188b7e25f7c9a5ccea5e
SHA512
bcaa2859339c2b1a1fb52f15aec35891f51ff34b19f60a9a27d2ad6bf29ba96733932e765a80d0a304b1370be0d12a6336bd0b295e8cc192f0d7e93a029898ce
SSDEEP
768:MeQAyOoNpGMIKhvihtcD/lCtX5gvC4/kyOWYGB0C+iGoHQq+vzaW+Ms/:pQAyO2pGMIbMlCtJGC4/kyJzGC/SXvzG
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
74c154ba48ddfe4aa1d0d660e58fd0cb_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ