DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
START
Behavioral task
behavioral1
Sample
ba0cfc483920e2f2be6d903fb5b8812a_JaffaCakes118.dll
Resource
win7-20240708-en
Target
ba0cfc483920e2f2be6d903fb5b8812a_JaffaCakes118
Size
67KB
MD5
ba0cfc483920e2f2be6d903fb5b8812a
SHA1
f62f745c297258d5e7f7ee85d858462b91dc1ebf
SHA256
caa7feb31a39d32e3bcc508ea5a9eb850369b47ce0831c442e055344978bb251
SHA512
d7c968e7dff693123d62515f4e1023c6675a9bfe8399f0e0b2eb4891f0c357102f65fbc3f7ab6fd838f59a8ad88335bb46f29eacb0e9c49de62e31440317f428
SSDEEP
1536:ZXRfOOKu+DdZTH979ImzpEEnZgl6XgN6nET0pKLV6U0qGlGv5:fSDnPpzpVgT6nEA06qGYv5
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
ba0cfc483920e2f2be6d903fb5b8812a_JaffaCakes118 |
unpack001/out.upx |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
START
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ