DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
bcc97dc13b66bb1eb53c85906d323f9e_JaffaCakes118.dll
Resource
win7-20240708-en
Target
bcc97dc13b66bb1eb53c85906d323f9e_JaffaCakes118
Size
80KB
MD5
bcc97dc13b66bb1eb53c85906d323f9e
SHA1
b1f8d6cdf0df9e0488ac23c0f4de127d660c77a9
SHA256
49f8f12c0e0ec3532a8ba624335eabeaa783e547d7abcfecd09150720e841dd7
SHA512
b5d419db0cf182db46ee79e00f1942e6e5e825cde65e24e4a323eab82a483004fa2ead6e076d59ff4fcc4736fbbf7eec7c0fb4ef97363b46e1ff4d32cbe80e33
SSDEEP
1536:DOns62NpetzTiVnBck6WFg65+wK2LXz02SHxBY:DOnj2Npkzup6W+65+X4XeRB
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
bcc97dc13b66bb1eb53c85906d323f9e_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ