GetVersionInfo
component_getFactory
component_getImplementationEnvironment
Behavioral task
behavioral1
Sample
2c7c78afba151d7b197ec549baeba4ad_JaffaCakes118.dll
Resource
win7-20240903-en
Target
2c7c78afba151d7b197ec549baeba4ad_JaffaCakes118
Size
25KB
MD5
2c7c78afba151d7b197ec549baeba4ad
SHA1
92702b2b80ad499ab1af66daf34e4831324051e3
SHA256
637c183a70f2f57e28fe0001dee6dcb836dede6d4cbe3b5ff65d50da8e30a950
SHA512
4ec7a704bbf219b7ba490bbb08de36ecaaafd33dea046c6e1e30a22d16b1bf7f8571c8bb38596a262dbd1f09f766b4abe22502dbd8f92110a5671cf519cfe112
SSDEEP
384:Y0tI5U7ypcqxJmGdnD4kQATveLstE43rs+U9xngL/uygVWikoiWPFus:YN5KaxJmgnDOjQ1v4zpEs
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
2c7c78afba151d7b197ec549baeba4ad_JaffaCakes118 |
unpack001/out.upx |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetVersionInfo
component_getFactory
component_getImplementationEnvironment
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ