DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
de8ee67929e919b61932417774df6aec_JaffaCakes118.dll
Resource
win7-20240903-en
Target
de8ee67929e919b61932417774df6aec_JaffaCakes118
Size
44KB
MD5
de8ee67929e919b61932417774df6aec
SHA1
e6cb4f4d4f9ccf3d5ae8d3c52731cc452d6a7788
SHA256
d26d0691ba65dbadb9956afcdfc76fd80d755a018ad7550bde694397c1eb0ce8
SHA512
91ab3158ad7ef2df69076335a6c73b3cc3994f48b47a322cfb0b7272bdf626a9b0f0fb2a6ec7433890d16a3a9c59a53dd43ffc715abccb8b6dfe11f7d603cbf1
SSDEEP
768:ANYrsk0StARLpAMFki6pn22TsijUX1eJ9AXQZ4Kh/ps8I86A7qJgABcFkJ/43:B304AR+mr6pn2VQJ9Tps8I86AmCUCkE
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
de8ee67929e919b61932417774df6aec_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ