CancelDll
LoadDll
Behavioral task
behavioral1
Sample
0eec071abdd9452bfdc73951a94d4ff9_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0eec071abdd9452bfdc73951a94d4ff9_JaffaCakes118.dll
Resource
win10v2004-20240226-en
Target
0eec071abdd9452bfdc73951a94d4ff9_JaffaCakes118
Size
62KB
MD5
0eec071abdd9452bfdc73951a94d4ff9
SHA1
5d65bb44f1f895839cd846934f82e0e3c395b01e
SHA256
424de8b4c4e431c7eb2519e810d0f6836ed0c68af5680887fe7f9938ce22d6e1
SHA512
162804386204ff4175fddd9a751cb19c1f023896b4f7f567e1b0876871243dc9743581fe46723f86437e7c860b64767a0f6583e703676b2035718bc02996d4f9
SSDEEP
1536:hXGa7ReQC6ithBfYHAfzBjVUluzTpTqlx6Mc4YAEQD:r7RCTtAEzjU4TpOltcWD
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
0eec071abdd9452bfdc73951a94d4ff9_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ