DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
cl264dec.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
cl264dec.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
cldabc.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
cldabc.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
cldabcd.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
cldabcd.dll
Resource
win10v2004-20240802-en
Target
cf7bb6c807ebf0f4b6388f3b5dc1fd2e_JaffaCakes118
Size
1.1MB
MD5
cf7bb6c807ebf0f4b6388f3b5dc1fd2e
SHA1
c6c1cb0543796d26c201868a8bf8b67abca3e021
SHA256
c1804cdf339acd28761d7ac390648225cb6fddbc114bfa3debe668bc87bebf97
SHA512
e3d71843b01e5d37693ccb49f3b363c041d1ff5bf25c114b6b257c7a542dc77102873cf61e13dc722bc4c60dd9c53680db711825808088aa337603ee25702041
SSDEEP
24576:6BGd2d693IDZg039U5ZtUFOoWoMESbhXr2OJmYo0ybmwqQxYR:6Bw2893In36GF4XESVr26mYo0E5qQxc
Detects file using ACProtect software.
resource | yara_rule |
---|---|
static1/unpack001/cl264dec.ax | acprotect |
static1/unpack001/cldabc.dll | acprotect |
static1/unpack001/cldabcd.dll | acprotect |
Checks for missing Authenticode signature.
resource |
---|
unpack001/cl264dec.ax |
unpack001/cldabc.dll |
unpack001/cldabcd.dll |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CreateCNonrefdecInstance
CreateIFMTdec
CreateMSMTdec
CreateVideoDecoder
DecodeIFMT
DecodeMSMT
DecodeNonref
IsDllUsing
ReleaseCNonrefdecInstance
ReleaseIFMTdec
ReleaseMSMTdec
ResetCNonrefdecInstance
SetDeocderInstanceIndex
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CreateCNonrefdecInstance
CreateIFMTdec
CreateMSMTdec
CreateVideoDecoder
DecodeIFMT
DecodeMSMT
DecodeNonref
IsDllUsing
ReleaseCNonrefdecInstance
ReleaseIFMTdec
ReleaseMSMTdec
ResetCNonrefdecInstance
SetDeocderInstanceIndex
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE