DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
02151d59e6a3b5a737b6dd803800d604_JaffaCakes118.dll
Resource
win7-20240903-en
Target
02151d59e6a3b5a737b6dd803800d604_JaffaCakes118
Size
61KB
MD5
02151d59e6a3b5a737b6dd803800d604
SHA1
de31531bd1617e0d42c3420686beba52ff5570ca
SHA256
a73f7127231fb24a5ffdd8338090336e5df640b5d05861c1a27db32f1d8edcb3
SHA512
279bcc9228873d877846c970f68e87e4d3804f00d01c0c5b2dbcc3ba297ccc55b77a51bec6f71b3d9b6bd0ab8ffc7a5098ae4c405a57103daebc33c7a0e11802
SSDEEP
768:OjrX4tW1y+A1nZf1s4my049uPdN2fJorH0/DBuasDLwgO5xetIWYa0t96V+WVnG0:Ojnp+910y04wf2fHBuPcrOaH7WUFq
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
02151d59e6a3b5a737b6dd803800d604_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ