CancelDll
LoadDll
Behavioral task
behavioral1
Sample
036cc4d76b5113dcf718eb485a2f08fa_JaffaCakes118.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
036cc4d76b5113dcf718eb485a2f08fa_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
036cc4d76b5113dcf718eb485a2f08fa_JaffaCakes118
Size
70KB
MD5
036cc4d76b5113dcf718eb485a2f08fa
SHA1
dfe9f29e0305a14f56521f7acc45f82443ddca35
SHA256
c8011b45710eae1c27fbf218b33e77c7fe1e5c1edcc6dd600628e741e5e106d7
SHA512
869dfca3f55ade7ab0ab345830df7136a5ce404e9b1663869527f39f807e331f5f8fc98e14a15df5e9f1b14d5598e9c41f696da49458f4901ff6539fc71c9165
SSDEEP
1536:lLTer/00I3Alu/vig/4eS6ZtuBhp2NDoYe791lOrYMkFI:FTeoT3A8SleSeC2NMYe7nlsr
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
036cc4d76b5113dcf718eb485a2f08fa_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ