DllCanUnloadNow
DllGetClassObject
DllRegisterServer
Behavioral task
behavioral1
Sample
fa897f81e27c69ad1612a0b4c9b748b0_JaffaCakes118.dll
Resource
win7-20240903-en
Target
fa897f81e27c69ad1612a0b4c9b748b0_JaffaCakes118
Size
60KB
MD5
fa897f81e27c69ad1612a0b4c9b748b0
SHA1
de8a42934f847447a22f0bc593fc1669b4c1487c
SHA256
73a007b54e0398bfd608703de822d3dd6312e12555621530a8a6b31bd86cfa69
SHA512
dbd6e67ab0e8488de9abfefac3db846d940ba852b87da9504385ab5ba360320549f3c5997aa140e1ec09331993e50e145a9272029acd77ace9e4884a86617e5c
SSDEEP
1536:S3Rc0QCAGQGSjYmc8Ev9T7Lf741DNV20lbOVYAPWdjQRJc:aS9GQGSkmaytNSYAe+RJc
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
fa897f81e27c69ad1612a0b4c9b748b0_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ