CancelDll
LoadDll
Behavioral task
behavioral1
Sample
f1e48e8d7e8d9a735b37763a81944f16_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f1e48e8d7e8d9a735b37763a81944f16_JaffaCakes118.dll
Resource
win10v2004-20240412-en
Target
f1e48e8d7e8d9a735b37763a81944f16_JaffaCakes118
Size
57KB
MD5
f1e48e8d7e8d9a735b37763a81944f16
SHA1
c73cae1abe555012fcdba01aa0d81acfe40c11a3
SHA256
6b28fdc2677259aa9a5a80be2451efdd71e230300b93b0329d93e37f8c47b611
SHA512
29f79e9656dc57a5c8445c9606743ee64f1347f9b9f3c816dd38566fb79c14bead61abf25532d5ce81ddcd7571e2bbca983b9edfb71d8bce5a22906162491c56
SSDEEP
1536:VOzB/iUiykXGJmDBaYK3BHeLpFeYlXpmM:VK/iUenaYK3qpFeAx
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
f1e48e8d7e8d9a735b37763a81944f16_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ