CancelDll
LoadDll
Behavioral task
behavioral1
Sample
0b535d94ae3e85fed51054b7767a3e27_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0b535d94ae3e85fed51054b7767a3e27_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
0b535d94ae3e85fed51054b7767a3e27_JaffaCakes118
Size
73KB
MD5
0b535d94ae3e85fed51054b7767a3e27
SHA1
e43dd1df271b9f3f7981f928785c31effe9e5fd3
SHA256
4ec36a3ea712ff1b992650567457b8fcf0a14170d29c77baec3ec3f1589031c8
SHA512
5f53821709905b23b0280d02ec832d7c2799b4208d2033f4c9cbe54afb813e2742c91daca96ec3783c9201f4361df7d87f88c0aa0842fba7056eb1af2944282c
SSDEEP
1536:OpwTqjU72hMDjB6SEuleh3o28dWYKCLIeLKRTxEuQ1xp:Os4Y8YehZ8dWokpR61xp
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
0b535d94ae3e85fed51054b7767a3e27_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ