DllGetClassObject
DllRegisterServer
Behavioral task
behavioral1
Sample
c12aaa20eca869f7b2b1d995ebe045cb_JaffaCakes118.dll
Resource
win7-20240704-en
Target
c12aaa20eca869f7b2b1d995ebe045cb_JaffaCakes118
Size
109KB
MD5
c12aaa20eca869f7b2b1d995ebe045cb
SHA1
e39d32b24b2785411dbcd1fdba7bff1198b1f43a
SHA256
8a071d0a8b208cd055e067fb561b3959d7f7f26305878b71254693fe3a2c2910
SHA512
49965de6c12b62babfdf779f4a5cadc480a7636d1ba3436377888c32bfddddff0268a164099aa22530205ad39f44cb9b4d562941e41f123b4572e863ca4a2a12
SSDEEP
3072:GYDVPO8plxXjDv9fWPRo3BwILS8G8Ulaiz/RY:lpmmf/V+PGRjdG5AU
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
c12aaa20eca869f7b2b1d995ebe045cb_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllGetClassObject
DllRegisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ