CancelDll
LoadDll
Behavioral task
behavioral1
Sample
1abebe5c51bae91b7323503b47dc862e_JaffaCakes118.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
1abebe5c51bae91b7323503b47dc862e_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
1abebe5c51bae91b7323503b47dc862e_JaffaCakes118
Size
67KB
MD5
1abebe5c51bae91b7323503b47dc862e
SHA1
9119ec81ada33c5490a98fa5a2dd5d0cddeff94f
SHA256
f3ec5c587eea46d6ecfa08d2456eb02d3420606e01cb4930b1d5d77013b3af1c
SHA512
94dce1f9c073c26c6c6cb69b5bd97a9f7a111fd488fa7ff1f73b322e4e25db7615f95455013fe4174b2743534354ab4fc9bd52e33f157f3f3e1bd971047bf25d
SSDEEP
1536:hXGa7ReQCvY6zIfZJKvm5B0xJ2+7oSEdWVheu:r7RCg6z6Um5KxJT7o1yJ
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
1abebe5c51bae91b7323503b47dc862e_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ