InitSQLConnect
SQLAlloc
SQLClose
SQLExecute
SQLFree
SQLQuery
Uninstall
Behavioral task
behavioral1
Sample
fe8bb29bfe0ba4b686e0c2e2bebba542_JaffaCakes118.dll
Resource
win7-20240903-en
Target
fe8bb29bfe0ba4b686e0c2e2bebba542_JaffaCakes118
Size
67KB
MD5
fe8bb29bfe0ba4b686e0c2e2bebba542
SHA1
344f103dd127e4611da74ea0c055e6e13d75aaa6
SHA256
ecbb74b26f8ab3300250f0394eda5ccb9ff01fe2b832ea579f6fe6c64bca43b8
SHA512
4ad866346ef85bcaf1dfdb72d85996a4cc2f0220ed261193e1890cbd6b15c1cbfb03a0d0ee74ae3f120125a7636f2c000453c6d0a0517d5ec1057ef88be5d88a
SSDEEP
1536:RIcEcDGr+a5lMp3oJuRLqV7E1N2MGZDPDMpMvaciA4:RdEcDEjMp3im2MivtvbQ
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
fe8bb29bfe0ba4b686e0c2e2bebba542_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
InitSQLConnect
SQLAlloc
SQLClose
SQLExecute
SQLFree
SQLQuery
Uninstall
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ