DllCanUnloadNow
DllGetClassObject
DllRegisterServer
Behavioral task
behavioral1
Sample
d662adf04d3a10433d3b64629783a531_JaffaCakes118.dll
Resource
win7-20240903-en
Target
d662adf04d3a10433d3b64629783a531_JaffaCakes118
Size
8KB
MD5
d662adf04d3a10433d3b64629783a531
SHA1
908ea472ca300c33d280564d63c306c2fe811adf
SHA256
f5db5b06ae763b799e59247dbefb585f5f6e2a2a53f29852c3aadaa5aa68b203
SHA512
56263a54cc9e7f9dd7f7a8347ff6e0496a301b945b68db910dddca4a9ec72eca66abb69f8939dbad7279268f224a412f648060d23842e07017c10a338a4924d2
SSDEEP
96:RsMvz8QLbv/i7i78nVTD0Szkxi3xDrqzq1TOXFeyhlKlmD195cdljv7uYOqH5fFF:RsEF7II8n+zxg2uB5vMuv7L3JF1MSKS
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
d662adf04d3a10433d3b64629783a531_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ