DllCanReloadNow
DllUnregisterServerA
Behavioral task
behavioral1
Sample
a65818a98e8ff8318d1b96f3fde14c3f_JaffaCakes118.dll
Resource
win7-20240705-en
Target
a65818a98e8ff8318d1b96f3fde14c3f_JaffaCakes118
Size
30KB
MD5
a65818a98e8ff8318d1b96f3fde14c3f
SHA1
7aafe1688839b12fe067619e28729a7b65d66542
SHA256
b4df13715bc383555f22cfed99e93a3c07862b11b56dada91610a5fef12a817d
SHA512
3c7b462df3b84d24963a94287eb97ae0014cee8883a8d003e0ab13a3a65941bc89f6770280d4e62418280d501b7a251937c93e0b6426f32d785d5ef6545d36af
SSDEEP
768:vRUu7U4W9LuWhXVtmv0FXCMPJMEmGlyMew7EzfU/r/Hd/:vRNTWJuWBK0FSpEFFCfCrl/
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
a65818a98e8ff8318d1b96f3fde14c3f_JaffaCakes118 |
unpack001/out.upx |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanReloadNow
DllUnregisterServerA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ