DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
ID
InitO
Behavioral task
behavioral1
Sample
d062ef816bff93a8e7610401f27e21be_JaffaCakes118.dll
Resource
win7-20240903-en
Target
d062ef816bff93a8e7610401f27e21be_JaffaCakes118
Size
35KB
MD5
d062ef816bff93a8e7610401f27e21be
SHA1
c2f1850cc141985f6d39506a134ecdc2f85ec46e
SHA256
625042a3b9c92dd707066de9bebb299fc8bd19584ce228f68100cd383a65f86c
SHA512
dd9c273e177a8648617c55550ca26c020cb6b1feee1c58677f7ad77e2f50bca6347b18f0ec42deeb0a2f7485863df774347984e3111ee2a09f3276d2c23ded03
SSDEEP
768:V0Z+DY0WGsBUg+xDzxkzSq3vOx7bkt7caAOz:VcoSUBpzxkzV/Ohkt7caN
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
d062ef816bff93a8e7610401f27e21be_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
ID
InitO
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ