DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Service
Behavioral task
behavioral1
Sample
2ccd6259190751230d46f273c4124a29_JaffaCakes118.dll
Resource
win7-20240903-en
Target
2ccd6259190751230d46f273c4124a29_JaffaCakes118
Size
101KB
MD5
2ccd6259190751230d46f273c4124a29
SHA1
1ead226e7fb44a58a20bdaea3443833aafeca5ee
SHA256
e81b7f646e87b7e9b408419026d0e47ba39f5d4f8833ad0ca8f409b2b5be48e4
SHA512
d918001c3a5e0ccbe1b038546c824ba55725dab28ebc7d0b5275c038deb32addf9075efc101c491bb2e23bc03a3fce0bb9bd682a3d3805939cd4b1fac4b814f9
SSDEEP
1536:wK2Jq0rJ7rPF/fAkkRIWBR7U0eto4EDJS+X7ccsXQKHdtvd8N3DUo69OExDm:wV7rPFHADRSt2FMdd9GYoI
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
2ccd6259190751230d46f273c4124a29_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Service
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ