CancelDll
LoadDll
Behavioral task
behavioral1
Sample
e2b8bcfeee15439f205cfb1b50fd61f8_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e2b8bcfeee15439f205cfb1b50fd61f8_JaffaCakes118.dll
Resource
win10v2004-20240319-en
Target
e2b8bcfeee15439f205cfb1b50fd61f8_JaffaCakes118
Size
65KB
MD5
e2b8bcfeee15439f205cfb1b50fd61f8
SHA1
4e2fb12131d2db9ff8a00f8c9ff4b1f55873550d
SHA256
c1bfd625c9bf41d8ffde063f1017c330ca2e0d33868757be037343ccaf0ca264
SHA512
fc1d57c610139ce6790ca8fc70f2997a6dcd0f5ed4e0121db5011b15c472fc470b8e31e9b4ef4b24b4781d7d606562a62b5099d4a292390a46c6f263fe95e62d
SSDEEP
1536:NomNZnI+CQSrN8eXdJ9ux+FL3fyOv8T19v0l7k+fxX:NooC+CXXHsx+ppUx98kWX
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
e2b8bcfeee15439f205cfb1b50fd61f8_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ