CancelDll
LoadDll
Behavioral task
behavioral1
Sample
0fb34e4c49da4e494839443708f86529_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0fb34e4c49da4e494839443708f86529_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
0fb34e4c49da4e494839443708f86529_JaffaCakes118
Size
77KB
MD5
0fb34e4c49da4e494839443708f86529
SHA1
898b99591f6a8c5a252e97ce08a82e70ae6ff73d
SHA256
867599e7c87149a4e3e0f2277b0281c40638001bcb27668386d7c045e556773e
SHA512
473bbe0610182f834d31a5c8fdd3d87faf49f09e3b4a967de04e0d514d07c262d2fd84c66a71da09ada6931135cd7608c1fc1375a2b0842216e2c321e545ca2c
SSDEEP
1536:IykzkagzxVZw5SclT2H0Qf97op90WiK6QE6bgvxSlyHtPV37WVP:IFzkaobwki255oMHnGI7eP
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
0fb34e4c49da4e494839443708f86529_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ