DllCanUnloadNow
DllGetClassObject
DllRegisterServer
Behavioral task
behavioral1
Sample
fa70600e1c52615e2f071876bfaf1fc7_JaffaCakes118.dll
Resource
win7-20240903-en
Target
fa70600e1c52615e2f071876bfaf1fc7_JaffaCakes118
Size
58KB
MD5
fa70600e1c52615e2f071876bfaf1fc7
SHA1
087a2cb2a7e2736c8697a4ef98ad8a7d68fb1061
SHA256
5ce0b4a749ec835af1f48df845568a4d5969c2d43657a359ac898d6207c01046
SHA512
9a79476ebfbf8acfe85b6cfe0db21d734011e2f496a08ce046ffaa47aeb34566aabd5d1b2d14e72c7952c699aef6d6a9ef4ced345404ba288986ec4f5c73c582
SSDEEP
1536:CEbZ8NmhOkQlvhgF7SMrEnZiI7NLUCttRcl:RbZ7hMZgJSMgE05ttRcl
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
fa70600e1c52615e2f071876bfaf1fc7_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ