CancelDll
LoadDll
Behavioral task
behavioral1
Sample
0242195f29c352e9ba7326b55ea6101c_JaffaCakes118.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0242195f29c352e9ba7326b55ea6101c_JaffaCakes118.dll
Resource
win10v2004-20240611-en
Target
0242195f29c352e9ba7326b55ea6101c_JaffaCakes118
Size
56KB
MD5
0242195f29c352e9ba7326b55ea6101c
SHA1
e88ed7ffc5c6a1b13965da0a48122a58ce8775b4
SHA256
c6388d494044fae2d0ba6995019615619e89ac9aa07830b9ab649b5151c2ecbb
SHA512
16549144f65a54861ad38be368a23060c294e93e2947507f2b7b6d4e39924fff3a70f3610224e2b08e55f7ec3dfe6dd127f3bfc92520944dbd0323cb148c258f
SSDEEP
768:FPUwXWaTfRELlWCQbnB1r04MLQok4iZDcAA6NCEqrPvecMpvkF6+X9WQ521XxPuL:hXGa7ReQC2Tr04BThcz6NClm8CPuvBh
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
0242195f29c352e9ba7326b55ea6101c_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ