DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
17fdfccd996a8ee0011b14a27c060c22_JaffaCakes118.dll
Resource
win7-20240903-en
Target
17fdfccd996a8ee0011b14a27c060c22_JaffaCakes118
Size
15KB
MD5
17fdfccd996a8ee0011b14a27c060c22
SHA1
ca5543f20a9f0072f38ad716018e3353b06e219c
SHA256
adf575fe75432e7ae5a078867bab59560eefeb17b5b5a52fc6affcf105282c71
SHA512
0b9836ae5c0b5e48583acae2124ce3a5c8e0d6f5aca4b97ecd3f1c8f34d162748a874fa35a22dfbabff166ae84105b8029bc77abbe6a7710a5dfab121c811ecc
SSDEEP
192:Yd9gkomHleA/8rWM9V18yoboaN6k1lJrjCeVNhKv6WLCB1QCyDsbKCTA:pkomVvM9V1ZiJL1lxLNKy0+1Q22C
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
17fdfccd996a8ee0011b14a27c060c22_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ