DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Uninstall
Behavioral task
behavioral1
Sample
b2e0d43ac994b95839af87587a50d9dd_JaffaCakes118.dll
Resource
win7-20240708-en
Target
b2e0d43ac994b95839af87587a50d9dd_JaffaCakes118
Size
29KB
MD5
b2e0d43ac994b95839af87587a50d9dd
SHA1
8d49252eeafba8616c05e93274907e7c28ec9490
SHA256
88621faca76fec9450a23a700e6ff3519da691d204b3f3485e23f3acd94e16c0
SHA512
90b8ff93e322e6ed659af8cb81eb79025d0dabe696db36a1b9ea6fedbd964700e3ea8277ae4f21dbbfd5239e93825cc3328a7d7f9b4480c6b61483923eee7099
SSDEEP
768:Jxp1zfXKPkwLKzirsIbT36ZXmAhc9S5DcteynJB:p9f9bIKNmAh/DMlJ
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
b2e0d43ac994b95839af87587a50d9dd_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Uninstall
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ