DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
a0c95af6e105c92d0b8e2d030a46c0db_JaffaCakes118.dll
Resource
win7-20240708-en
Target
a0c95af6e105c92d0b8e2d030a46c0db_JaffaCakes118
Size
13KB
MD5
a0c95af6e105c92d0b8e2d030a46c0db
SHA1
8b207e37f654825e99c27d9e4461eea0e6df7d07
SHA256
17ce6b89fbb2fa005b27af8854bcbe67c9eb3df16045327bdeedd5d5e1bcd694
SHA512
752162584af2e4f12af2c334cbb3218ccfce0ca22263e9421f37ddc856b3d59350a8552ee8b9e93b523fe3d2951e9899c8dd1a05b2bb4ed32e3d37f76c1f6746
SSDEEP
192:5kvPVM6rsrkIBI8IZU40StJDcJ27D+KKRdpQV4sVpYeD6vaMg3mxHWNpA:54NM6YrkWeZU40STcJ2aB+CVaMgEWN
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
a0c95af6e105c92d0b8e2d030a46c0db_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ