CancelDll
LoadDll
Behavioral task
behavioral1
Sample
f32208bd0485beec50e465a6a95af54a_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f32208bd0485beec50e465a6a95af54a_JaffaCakes118.dll
Resource
win10v2004-20240412-en
Target
f32208bd0485beec50e465a6a95af54a_JaffaCakes118
Size
72KB
MD5
f32208bd0485beec50e465a6a95af54a
SHA1
5644211eb3b3b80491bc596d755c0132234fa3da
SHA256
0651c319f0f578804968156cee29c6e5fa565cac5ff3eb5ea243758b51a4966e
SHA512
dfef6f5ece97e198a0bdbb2625c3cc26b4cb82c742b45099cba1d867d3d974a696bf105c8cab05a5824af1bf603be97ada7bdfc6feb0724856c1e39ef739a1d1
SSDEEP
1536:DVV1HTihtlENB7SVSJE+f5ssmRtjcHJ0x6Ek/yiMKa9zDc:DVr+hLEb2VS++hss0qELk/BMKADc
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
f32208bd0485beec50e465a6a95af54a_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ