DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
ab6968d57c8bc3e4087d5054dc2314a7_JaffaCakes118.dll
Resource
win7-20240708-en
Target
ab6968d57c8bc3e4087d5054dc2314a7_JaffaCakes118
Size
16KB
MD5
ab6968d57c8bc3e4087d5054dc2314a7
SHA1
f61fd97927398b6ddba6ee83fc3b4228ef105079
SHA256
194f1af417412647c341e30d31e716db1f207ea21f00e391ff9fc69a731eb600
SHA512
4a44296bc2ebc09b8be2d085646781186b099eb4e09b7049b125c48e44cadb37e4907640217ac528cb20bbcc91100f47bbb83c8a19c35cc5011219b02caaf24e
SSDEEP
192:iSOJtWj2HZqxGYee9Pa1/v4rWBbYAjOATqYzbREry5FZn1ywnLW/WiyPPA:ZOJHYSarqbHjBTqob0y5FZ1FnLW/Wiy
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
ab6968d57c8bc3e4087d5054dc2314a7_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ