DllCanUnloadNow
DllGetClassObject
DllRegisterServer
Behavioral task
behavioral1
Sample
137cf3def6a492055a90b7774104ecf4_JaffaCakes118.dll
Resource
win7-20240708-en
Target
137cf3def6a492055a90b7774104ecf4_JaffaCakes118
Size
56KB
MD5
137cf3def6a492055a90b7774104ecf4
SHA1
414c0c7e89ad7b3167665a3b36332c85d346636d
SHA256
c5851cf2aabb2a9895b721949aedfe33bb632f9802625586ea5aa82c591680e7
SHA512
afcba981ed6ab1c9c395e8b361ddf9ab79be39d37986cd745c7c35beaaf8eb5219e0e8b2017a9131acffdd90253adbe2b3f3cd60d7a9311b51e1770aaa28b4d3
SSDEEP
1536:2MxMJMRoqY5jVCIztp7gyhvFuF99YNMwGkyVBwtVpOlc:2VJMyqY5jPtBgyFY1wH0VBPc
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
137cf3def6a492055a90b7774104ecf4_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ