CancelDll
LoadDll
Behavioral task
behavioral1
Sample
183a843b448c073c320aed85068f7c4b_JaffaCakes118.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
183a843b448c073c320aed85068f7c4b_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
183a843b448c073c320aed85068f7c4b_JaffaCakes118
Size
73KB
MD5
183a843b448c073c320aed85068f7c4b
SHA1
9cd02eb5b96d5a4157047c9b27a63e33e9a6cb63
SHA256
b43c593a4a2cc09cf2179a57f86dfdbcd20e45bb1b557cea484ec574cc533819
SHA512
8625e07a1d97207ab46764e0683188415c959ffbc3966103edb376666e3c360591cc067e78642f0eb59d87d8ea29ffe417b364ca8577d0722ebc897c852675f9
SSDEEP
1536:L8NXippOnypDR/0dPAXtWiXNVPem9E/9SHyJiyBeOhERgoyj3JK2:4Ny6ng/0JAXt3Fox3eOh3oCZK2
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
183a843b448c073c320aed85068f7c4b_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ