CancelDll
LoadDll
Behavioral task
behavioral1
Sample
045ea3b7c30b9c7ccfe051632719d271_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
045ea3b7c30b9c7ccfe051632719d271_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
045ea3b7c30b9c7ccfe051632719d271_JaffaCakes118
Size
47KB
MD5
045ea3b7c30b9c7ccfe051632719d271
SHA1
3a4c4b8105401162e9ab4a30c8d5a5ab1f6cdcde
SHA256
cb894295293be94d0800ead575c8672aedefaf764131ab79fd5d35277ea9f7b7
SHA512
f47dd0e2ba3b8ee1b917ca6939faece1e207ed2a622a178d26ca065c048313bb54d77a96dd2bf739e3012e67c80d3a44a7ce6fab125237f7fdea98b99b295e0a
SSDEEP
768:NthfqCPgQ42HCntg3iCGosyPa7wTF5Gl0s3x5rDPn4fjj4oImnw7+p1COhpGt:NXflI2H+teiz2C7wx5o3x5vPnIj4Ansz
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
045ea3b7c30b9c7ccfe051632719d271_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ