DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
b4a4d5f5a3c1d270ffa58abb31f3c3f0_JaffaCakes118.dll
Resource
win7-20240708-en
Target
b4a4d5f5a3c1d270ffa58abb31f3c3f0_JaffaCakes118
Size
88KB
MD5
b4a4d5f5a3c1d270ffa58abb31f3c3f0
SHA1
211a5f471861da1622e1f7c4ef6f22d42a4ef48e
SHA256
fc5d2d4fd968d62cec850d6266e1d8f66527c2fcc7fa9548ca8904a74c3bcd98
SHA512
4e1d145ac94c2bd53469bc43870d443e8342cf6b932cec726b094401da5bdcbd3bc288dd5b013e7483eb6a10e0acae2ecf599613e9bbd393201384d18c5f64a4
SSDEEP
768:MvFH/jjFp6x2MjRWX0zIlnyFjQrnZ5/trwbgk83MsB:MJ/jDqFje0zIlnyuL/trwbW7
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
b4a4d5f5a3c1d270ffa58abb31f3c3f0_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ