DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
08a94b1720a17b61cda0b7414d14432d_JaffaCakes118.dll
Resource
win7-20240903-en
Target
08a94b1720a17b61cda0b7414d14432d_JaffaCakes118
Size
152KB
MD5
08a94b1720a17b61cda0b7414d14432d
SHA1
6580fe17709500746f413ddb0f321e7ca640c45a
SHA256
cdf7e74e513d36bdc0462763c89cc34b9a96f9bf1d6831c6473c02cef76b9fb5
SHA512
76cb3c2d55151bfb101cdf1921b549c9e165b2b464658b19ccf1bed24e7b8f32f060921a87e9a8b6478902293224c234ee3d3d2a2598d4008cd5841940fe6bf3
SSDEEP
3072:GsflKbtMfcU2PFOQa81FHoVEhm/NFW9kY0qUOG5teqH8eUxDZQEKhemqE7cGdyni:fflKbWfcU2PF/RoV+m/P4Arc4PMQThvv
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
08a94b1720a17b61cda0b7414d14432d_JaffaCakes118 |
unpack001/out.upx |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ