CancelDll
LoadDll
Behavioral task
behavioral1
Sample
f88af34ebf877252aa7b26bd4d3c1115_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f88af34ebf877252aa7b26bd4d3c1115_JaffaCakes118.dll
Resource
win10v2004-20240226-en
Target
f88af34ebf877252aa7b26bd4d3c1115_JaffaCakes118
Size
47KB
MD5
f88af34ebf877252aa7b26bd4d3c1115
SHA1
7fe00ac81c2867efd9e78c0845a79b5053071b1c
SHA256
79977f57b5e3a1e231474c0a5d88776cf1bf534974775172ec104d82a8cfec2d
SHA512
6510474ede50b4dff2be8fbba0074eb1eba3b16e859ad310c55f95d0ad4e318c7f685b3a08cadcd0e93a3b90a4fa819eb65b1e11724bad686d4265c326004238
SSDEEP
768:Yb/oc3OokLfNVJ+LrvlQ4YvLVAmBG1ZdSW8XN/IFAbfTG04PgmBKBlizQHfcgNsF:wAceoINVALxQ4YjV2D8d/IKR4PnMlua6
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
f88af34ebf877252aa7b26bd4d3c1115_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ