CancelDll
LoadDll
Behavioral task
behavioral1
Sample
ecead11bff77d8dd4f6dc0dfe08ece62_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ecead11bff77d8dd4f6dc0dfe08ece62_JaffaCakes118.dll
Resource
win10v2004-20240226-en
Target
ecead11bff77d8dd4f6dc0dfe08ece62_JaffaCakes118
Size
71KB
MD5
ecead11bff77d8dd4f6dc0dfe08ece62
SHA1
d405d538e583199721a6ef44cb94ea1c3efb68a7
SHA256
cd4b63b249c528ebd8c9e93a9d33b82a673c7a70624e155233fe33256d0a1c41
SHA512
e1be3bb84ca0e1b7bb51f6363047f830ce27ec35664cc278625edba79ddb3b955c93fe38f74b0cc78bb0c53c89edc6e0698f2be044cf9f624da65438702db7e7
SSDEEP
1536:V7LV29Z+qX6Z3n+4DshnjNGZ2BK2PwYcDsMXZ3phK7GXi:FU9Z+bZ3+4onYIBvQD9xaSXi
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
ecead11bff77d8dd4f6dc0dfe08ece62_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ