DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
fb67df260c9809b34cb7d55c4ced0e84_JaffaCakes118.dll
Resource
win7-20240903-en
Target
fb67df260c9809b34cb7d55c4ced0e84_JaffaCakes118
Size
664KB
MD5
fb67df260c9809b34cb7d55c4ced0e84
SHA1
f048fa9411f07647cce5b2e70dc54d20c6e33b23
SHA256
db97ffa967eb87b7b162b72502e7969cb5e132f2d27517096af94c5fba753da5
SHA512
88536eb192b73b69bd9c802445bb60cd180eb58d2793fb870d9b155c14cfd305d6646302758d99d2cec38b668f5b41a5a249519d168c5127b2d87e3ab4aa5184
SSDEEP
12288:8QfO6q8W6gSOPLjjbUL3lvp/A+R4zODXy2ZONJ54RVkZocRmt5CesQ:8t8W6mUWwy2ZW546nRmt5Ces
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
fb67df260c9809b34cb7d55c4ced0e84_JaffaCakes118 |
unpack001/out.upx |
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ