DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
2913a44c8d3d8cf4857a8f49c2409270_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2913a44c8d3d8cf4857a8f49c2409270_JaffaCakes118.dll
Resource
win10v2004-20241007-en
Target
2913a44c8d3d8cf4857a8f49c2409270_JaffaCakes118
Size
37KB
MD5
2913a44c8d3d8cf4857a8f49c2409270
SHA1
379a8f2a300ccfc9b32449b95d659fcc7ba0de43
SHA256
f707e17b27470e8543d3b8268e7d590348867974562a11770c0ef06e8fb0d1b5
SHA512
46a922d6cf4d03c3d78445e7f57db415748bbc7dd1261c42514ce7e33879b3c17b90ceb6228817ca5b6054d2e4817621015bd8b59876cc29f7ca5004f5e681c4
SSDEEP
768:/J+yTgW6EPLcREpOuu89apKMAch5Ak+LKZEKBxp7E/jmlpV4DnWtZzd2:/JLTgWylgMA2Ak+yzpQ/jmlErWtBd2
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
2913a44c8d3d8cf4857a8f49c2409270_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ