DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
InitEntry0
Behavioral task
behavioral1
Sample
fb83721252bf28284a04c883700ddea3_JaffaCakes118.dll
Resource
win7-20240704-en
Target
fb83721252bf28284a04c883700ddea3_JaffaCakes118
Size
86KB
MD5
fb83721252bf28284a04c883700ddea3
SHA1
a65d5d08ac1b216ac97a19f3dd78c5d3f82cf60d
SHA256
f63a7a75c5ef21c834dafd0061b77632652c07c2308f7a9d605fcef5f47d6eb2
SHA512
741580e761e06889c7bde840d94b503797d514cf71be86a857c77db59c6112339ef7775b42cd1c9238bbe891821f48a1ee30adb71cb25affea4c17fc8d9b60e7
SSDEEP
1536:nYvynn+A2Vp83OUrFESgpbQh6xjRa6TGEj+2b9UOTeGgDgjeAejBcClz:Yv4+AO834Q+NNiEjDuOKIAcm
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
fb83721252bf28284a04c883700ddea3_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
InitEntry0
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ