DllCanUnLoadNow
DllGetClassObject
DllRegisterServer
DllUnRegisterServer
Behavioral task
behavioral1
Sample
dff72b846823ab1be912100db16f689f_JaffaCakes118.dll
Resource
win7-20240903-en
Target
dff72b846823ab1be912100db16f689f_JaffaCakes118
Size
351KB
MD5
dff72b846823ab1be912100db16f689f
SHA1
00c4afc375185a07f6c193bfaf3db3035677a858
SHA256
f00654cfeca9c175895d4e3ed2e12a8b0abc7866baea07e174d73805a22e2e06
SHA512
ad1e4507b1b5ce5080147de29cd9e9b417bef8cc08ae6f5d88596c65ac4423e2641f9217d5de2e39b82c2bd8df0c969111b3bf25bbe232d0b601c7045fa2f61a
SSDEEP
6144:Vwu0a2qD5hiOFNGjALRxiEjzLL7X/yTS5izVaGXO4sR8rXf4OdOoTBBX:Sja2nOFNG8RzjzLX/yTTV7e8Df4c5TBJ
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
dff72b846823ab1be912100db16f689f_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnLoadNow
DllGetClassObject
DllRegisterServer
DllUnRegisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ