DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
d0129d0a95af4ddec8809fbc57c649ec_JaffaCakes118.dll
Resource
win7-20240903-en
Target
d0129d0a95af4ddec8809fbc57c649ec_JaffaCakes118
Size
24KB
MD5
d0129d0a95af4ddec8809fbc57c649ec
SHA1
10b9855b203096be486a45659497a7844405f338
SHA256
47a49ea5514d620b20066dcab8d3b813366140ed2c2bd844c5fcf5d84dcb1d2f
SHA512
26ffc8c194a6423883b8b2f9c0136f5825837f5cdd5684ab94e50e9c40db33b3796d97f11a393cd35f596b9a95654c7edd5165b46d264485b8a2d17b61ad8de6
SSDEEP
384:cLz40D8ZpZ9TDrQSKP7KEszpIpQs1IUlM2w/Wbzc7p5ZvyCiSy:c340D83dYqpIpi97+bzapvvyL
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
d0129d0a95af4ddec8809fbc57c649ec_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ