DllCanUnloadNow
DllGetClassObject
DllRegisterServer
Behavioral task
behavioral1
Sample
bf7c1670c2991c97492bad26a0851f9c_JaffaCakes118.dll
Resource
win7-20240708-en
Target
bf7c1670c2991c97492bad26a0851f9c_JaffaCakes118
Size
71KB
MD5
bf7c1670c2991c97492bad26a0851f9c
SHA1
0524bfcc9b6cbb236ad29f03abbd6d0a23b9ede2
SHA256
34614153b8ab7e08a6344345f25ea75c89a0f186903a70fbda758a8dec77d2d4
SHA512
34842ca4df6005ddf0d71ccbc8894ddfcec1a7db28122f46aa949c54b20e941f1e3e91401631546d4d3f710eacbf6a7cbaf383249abeffd150d1f5dad2c92bb2
SSDEEP
1536:sfzVF3zHmaHUuYoVwlnjCzWPUxQSpySEo+LTpYhFAck:+VFN0MVwljCKPUO6hOck
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
bf7c1670c2991c97492bad26a0851f9c_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ