DllCanUnloadNow
DllGetClassObject
DllRegisterServer
Behavioral task
behavioral1
Sample
bf8ccd4625debf9c0abcc66185ab4dd3_JaffaCakes118.dll
Resource
win7-20240708-en
Target
bf8ccd4625debf9c0abcc66185ab4dd3_JaffaCakes118
Size
30KB
MD5
bf8ccd4625debf9c0abcc66185ab4dd3
SHA1
d96ac795e67e3fdb8f3fb389738b8fb00bbff16c
SHA256
bf413dd98f8d7c21e66e1e22bd243ac7f0ae824c2f0d90a12daafedd3dce694b
SHA512
b03d4d899590181db3a4baf89eceea67451dca30f4cbd5875f95f27441afed2f838f97b9b0a1683a9267d58fa3f79a35b081eddd6e5e4eef98afe2a2f10d316d
SSDEEP
768:1Rb4bBZPD2Rqax3yTpdNYGxjx2Z2TVa91ele2VQE6:IbBZPq0myVVxrTVa2QE6
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
bf8ccd4625debf9c0abcc66185ab4dd3_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ