CancelDll
LoadDll
Behavioral task
behavioral1
Sample
17d8189872220453bde640d02f04eec0_JaffaCakes118.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
17d8189872220453bde640d02f04eec0_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
17d8189872220453bde640d02f04eec0_JaffaCakes118
Size
67KB
MD5
17d8189872220453bde640d02f04eec0
SHA1
e7feef96d7668af0b841a1e6bd0c81fcfa6966e5
SHA256
d35b646ffa0b930d2a20ecfb53a74063bb6bd0c05b29b13384a5e17e143c99c4
SHA512
93da9908fd7892391c7eb6d6d1c448ed9af8c68cac15d8637d2b2a5b140794ee1fbdb7e61cce978c2d5d718ee1a131e231076083bc5259f990e677b08262d41e
SSDEEP
1536:hXGa7ReQCp7lsSaeannogiSQGf+2G92BQyBcWaU2Lvc58:r7RCdg/nISQG22k2BQyyWancm
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
17d8189872220453bde640d02f04eec0_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ