DllCanUnloadNow
DllGetClassObject
DllRegisterServer
Behavioral task
behavioral1
Sample
94e44ac9db3b36c9cc6531a5e4a30642_JaffaCakes118.dll
Resource
win7-20240705-en
Target
94e44ac9db3b36c9cc6531a5e4a30642_JaffaCakes118
Size
8KB
MD5
94e44ac9db3b36c9cc6531a5e4a30642
SHA1
cafa5082562a4c03aa2fb3cc032b3131e6e4f20c
SHA256
f5f03c89ca4acc6fbc39de3c55d69ab875aa74cf8232c2af77415d927925dde3
SHA512
8d8e6de0269621176b25e60e9cae1a2b537dec603fa0ac16d9fefe125cce2b64fec452c405e63ef58dbf4da8296d5aa60eed2c7a30141ffe078636f6ce2786b8
SSDEEP
192:ixfpNHzSj5nNwD6TiRTwWTdNXpIHaql0/2u:iDJYc2GJFpIHa
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
94e44ac9db3b36c9cc6531a5e4a30642_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ