CancelDll
LoadDll
Behavioral task
behavioral1
Sample
0c6a1431d9ebfba4a7a67c2c927b3b62_JaffaCakes118.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0c6a1431d9ebfba4a7a67c2c927b3b62_JaffaCakes118.dll
Resource
win10v2004-20240611-en
Target
0c6a1431d9ebfba4a7a67c2c927b3b62_JaffaCakes118
Size
85KB
MD5
0c6a1431d9ebfba4a7a67c2c927b3b62
SHA1
fc9b16f166349b3c0de5a7cae53e8412a1147bb0
SHA256
0dc5aa79b5446790dcbe48f55aabfae7fbf6b72079fa7e16c17cdf8911de4929
SHA512
1db274a7f04ac3de2e669b2e153212c0d9960929ffe9a3e37e30065f8dbf8844ec630bf5201b4a68eb2ce54c9bee7d18e3cfed7c11f7611fe279a20ec9d90eb7
SSDEEP
1536:BzohkS0cdTiMbnAX7TAtfbuyAG7s1SmyVYtJK3y9mG9GvsPkecV3:toCcdTnbnAX7TbhGoZyVYtJAvdaPQ3
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
0c6a1431d9ebfba4a7a67c2c927b3b62_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ