DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
TestFunc
Behavioral task
behavioral1
Sample
da87798b401d8a669e53e8b47ef0f20d_JaffaCakes118.dll
Resource
win7-20240903-en
Target
da87798b401d8a669e53e8b47ef0f20d_JaffaCakes118
Size
16KB
MD5
da87798b401d8a669e53e8b47ef0f20d
SHA1
5531c8150d1628c0d37a35500d4d094a34a52c57
SHA256
dbbb1540a230af8c865881efd4a68c6b6b5ef0c9066c1e5e1d6ff91201a35220
SHA512
123e681d480403e10d52e62c7a0a60305af346340a6c12c9ed0d061df61fb8f9d6fcd374d6371ff81362682f262d4b4bb2fdc80f76df223ad80bd78276f128d5
SSDEEP
384:fNA8Ut550fIWQH6aG7B3UmpOWfgR3XlDbckNU:fNff5QaaQUcIR3XFs
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
da87798b401d8a669e53e8b47ef0f20d_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
TestFunc
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ