DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
ID
laspi
Behavioral task
behavioral1
Sample
96237e6dfe6c981e6bd5af76839f82ca_JaffaCakes118.dll
Resource
win7-20240704-en
Target
96237e6dfe6c981e6bd5af76839f82ca_JaffaCakes118
Size
33KB
MD5
96237e6dfe6c981e6bd5af76839f82ca
SHA1
9d9bb2686883e1952b1bd288174b0e775e5034ba
SHA256
deab06ca8a8bd720d8759b61dc86a3636574bbce13e1be7a3c8f162f2363a1f0
SHA512
3bb131472665845a5f9ae7963701a8eefd2dea210e727d0a9693b2d0cb2ede8ee5182958f8853b5e82451d4d8882f2ba090d1b4e9a126be68801966421f67121
SSDEEP
768:zTTkbb3uqE3nOq2CK0c5EJxlY96mL4LoiwT6/xebv:fm3uj0CK0cO89XVrOxebv
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
96237e6dfe6c981e6bd5af76839f82ca_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
ID
laspi
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ