DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
a6de1462bf0734f4228054e706aea909_JaffaCakes118.dll
Resource
win7-20240708-en
Target
a6de1462bf0734f4228054e706aea909_JaffaCakes118
Size
56KB
MD5
a6de1462bf0734f4228054e706aea909
SHA1
ccf67dd6bdccb57d9bc2582905c2e5af0659a219
SHA256
c8fdc1626a6589b51c46e9b49c218d56f1d592897a6c3a868928dbc368e6264d
SHA512
5dd5eedf93b092fd3f3cf5e999c8348ca72cbc26536248a4be515da34e348fcf437be71852e27816ccd7da57e6860ef73765401a7215f0fd86d2b620840f9eb8
SSDEEP
1536:nyGHusO9SjgCLsHCl7tcr1Zyml7UOK/5T41rApzzO:ntusC2Zur/ymuT4FApH
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
a6de1462bf0734f4228054e706aea909_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ