DllCanReloadNow
DllUnregisterServerA
Behavioral task
behavioral1
Sample
dc1133282b6e9e9f81e6bb397a7c09e2_JaffaCakes118.dll
Resource
win7-20240903-en
Target
dc1133282b6e9e9f81e6bb397a7c09e2_JaffaCakes118
Size
24KB
MD5
dc1133282b6e9e9f81e6bb397a7c09e2
SHA1
6dee61dccf779ddbd7c779cd10b4fd2545efeb2f
SHA256
65de9b608403694afed614b907c21319640459a49d16e8d5141fad927e5b598f
SHA512
ab82f5916a442d744141d170a65d7172032fa219c6071449bb04fca41a975135757f5d1b2aff0a7424c60b5eb329fb0c477b4bcaf6c39b76522488274a193e9a
SSDEEP
384:vDtKK0hjS+l4XrNlQVqXNN785ruu0AorBIGenA6Kf/X/W5fXmHN7S2:vDtKK0hm+qnQVSV85rv0AoSnAnb7/
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
dc1133282b6e9e9f81e6bb397a7c09e2_JaffaCakes118 |
unpack001/out.upx |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanReloadNow
DllUnregisterServerA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ