DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
104f7747a9d0f3b18b1f4f4c198af24b_JaffaCakes118.dll
Resource
win7-20240903-en
Target
104f7747a9d0f3b18b1f4f4c198af24b_JaffaCakes118
Size
27KB
MD5
104f7747a9d0f3b18b1f4f4c198af24b
SHA1
46aba50cdd4eba826cbfd35bb91fe79fd601f1cb
SHA256
cf4fecc78d130210c91451a6fc13d7836d6b7ae7e066788ab97bd5939a77928a
SHA512
0801a23d4232c6a7b148ac0c83e39944d0121d7265592b27832a5b09569c41a8271004b0e27c4adf8a31123579fe0ce9f06557cb1f6cadc2f854e61c61a97ace
SSDEEP
384:QSrBtrpAVfbahJeklLLVtk6OX8f1+6TCFMHmgBH0NEo59EwuOv5zfZR7McMu:QOJAyJvl1/f1+6TCFMGguCOFMu
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
104f7747a9d0f3b18b1f4f4c198af24b_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ