DllCanUnloadNow
DllGetClassObject
DllRegisterServer
Behavioral task
behavioral1
Sample
b8b2fb78d84bc6a4bdd2912f068bc4e6_JaffaCakes118.dll
Resource
win7-20240704-en
Target
b8b2fb78d84bc6a4bdd2912f068bc4e6_JaffaCakes118
Size
24KB
MD5
b8b2fb78d84bc6a4bdd2912f068bc4e6
SHA1
aaa829507804c49292cff72c77fe9066d15fd0c9
SHA256
97d294a75e2230d6db3eea23a159a6104d4110df427a821a30a87ecee20ae451
SHA512
66ccbe90a3cd9c4a45939e3589b96a27137b67de4ed84de3fa0b9293138cae94b442e79c8229acacf0d7f0dc44fc48d4a3194836e26c02871248350956321810
SSDEEP
384:zSuHLIRHnBFaE2v9iOOCV2hUo/eGCk3ClWW3MdysnmZfZUUqP7:uuHsRHnBkEpAJo/0VX8ksnG+j
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
b8b2fb78d84bc6a4bdd2912f068bc4e6_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ