DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Service
Behavioral task
behavioral1
Sample
03ad980d78ac5f0ddb0fb5f04009f2f2_JaffaCakes118.dll
Resource
win7-20240903-en
Target
03ad980d78ac5f0ddb0fb5f04009f2f2_JaffaCakes118
Size
103KB
MD5
03ad980d78ac5f0ddb0fb5f04009f2f2
SHA1
da56faa06d8e0ea00a87a8ba8eecb4b801141752
SHA256
1e267d553ea706db0d6b81ef543ed0158e001ec73257735a4a72a0f63867e3fd
SHA512
f5fe4f82606d328a853868ed7e12f02fad62107a552503e236089b14a1116c9c2a1dc9b2bf8d2219dcf2d89181df519cf88390443356cab32585a0e615114e78
SSDEEP
3072:OBKVJYWXx5h8MBBv2D0dV9A4CUNveHN32r:SGLzt7ReHZ2
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
03ad980d78ac5f0ddb0fb5f04009f2f2_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Service
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ