CancelDll
LoadDll
Behavioral task
behavioral1
Sample
158dc4d2a8be0d6ec89f0b5315eb5d16_JaffaCakes118.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
158dc4d2a8be0d6ec89f0b5315eb5d16_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
158dc4d2a8be0d6ec89f0b5315eb5d16_JaffaCakes118
Size
47KB
MD5
158dc4d2a8be0d6ec89f0b5315eb5d16
SHA1
1b449d9a34ec365125a9471194eec07b0ff3a9ca
SHA256
d5cc16f3b98ce35fca76e91f206f1cd65648b84ae440171b45b2fc4ac27888b5
SHA512
28fa1ed7ddad6c62ba8b5e589f929b98d020368b544833c44183303aebf838dd296e73a9a66c0a21695eaa87709cf65d87cd44ad01f2fda5d54976ab8596027c
SSDEEP
768:M7Zm5Jqexe/4snn+KLfu5V/224i3KI6hVrV8SY+kj+GaN6+oXHRWM9RPmSLxvnX:MtGxxe/HnSec3KI6hVrVbhE+G3ASxmSJ
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
158dc4d2a8be0d6ec89f0b5315eb5d16_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ