DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
START
Behavioral task
behavioral1
Sample
777f8a7c5b4de2c041ded43f36da1540_JaffaCakes118.dll
Resource
win7-20240729-en
Target
777f8a7c5b4de2c041ded43f36da1540_JaffaCakes118
Size
65KB
MD5
777f8a7c5b4de2c041ded43f36da1540
SHA1
6a88c3d9cc61cbcbc800195ec7e081e7eb3e761e
SHA256
f3ba4cb8000982ec2d3c4c8acf2842d7b0876e6c0072d95255d20edbce630ee1
SHA512
f7c17df1a750e2d0451817c4409266b46815a6a5c4275bd384647b8d245d811663a233a69c690db0f0d5994a4126c26d57f180894e037c573f736dce8cb7ba03
SSDEEP
1536:NrIb6l/55SO0XkOGv9m5FmC6413dUMuXNCkBwotfUH492NmN+hon:NrIi5CUz9m5FLJxuXNCOvy49gwcon
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
777f8a7c5b4de2c041ded43f36da1540_JaffaCakes118 |
unpack001/out.upx |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
START
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ