DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
d614e72623966aadaaf2e7cb5a72dec2_JaffaCakes118.dll
Resource
win7-20240903-en
Target
d614e72623966aadaaf2e7cb5a72dec2_JaffaCakes118
Size
23KB
MD5
d614e72623966aadaaf2e7cb5a72dec2
SHA1
a43138a891c1ab3dde98c61870c8da9a1a6e2dfa
SHA256
cdbb28434bc15f123276aab65d2635e37abac37b2322fcb169ae7a86e528503c
SHA512
1c527487b57adb193d91f14bd9f874fe7cddeb5a9ae73e8044ea9201c0bf22c50ae07af0ea7db76385187971de3db060281225ecdf8be1926cd2ebf86886ea97
SSDEEP
384:4ZVKtMCzhG8TmZUmyQYP+SABvExr/Bbrz/iTVDHbcZ9jQwn16uoeWHpM66kw+:4Z0tMCz1ThDAMr5b/qTM9pn16VBHGLkw
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
d614e72623966aadaaf2e7cb5a72dec2_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ