DllCanUnloadNow
DllUnregisterServer
Behavioral task
behavioral1
Sample
0aae18d03bccc07e326165fe106faf94_JaffaCakes118.dll
Resource
win7-20240708-en
Target
0aae18d03bccc07e326165fe106faf94_JaffaCakes118
Size
27KB
MD5
0aae18d03bccc07e326165fe106faf94
SHA1
503a4cbb0b0829b9ab25c331b81d85fd2b0e383e
SHA256
f321707f4b46bcd16dd5e774cc80a064137d315eee07909b5f8096d451d36e68
SHA512
c2402338a7aa6921507cdc725c931faba387f1b40c03f5d91dd067cbbcfe5dc2073383f7d61d2a6b052f8168b0e4d623b4dd9cc32ed730c2b5d6565893dd532d
SSDEEP
768:nStC5ER3RwrEhrvbO4r0DLVXQThRTlXA4A4i4UOC8:nSLRIERzOBVuTo/8
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
0aae18d03bccc07e326165fe106faf94_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ