CancelDll
LoadDll
Behavioral task
behavioral1
Sample
1b7c7dafb81417f9992354736783703e_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1b7c7dafb81417f9992354736783703e_JaffaCakes118.dll
Resource
win10v2004-20240611-en
Target
1b7c7dafb81417f9992354736783703e_JaffaCakes118
Size
62KB
MD5
1b7c7dafb81417f9992354736783703e
SHA1
de0d2db7d67a54f428f6f148b3cd6e4e33447074
SHA256
143ce9da144df10bd177302fcfef3abc2943aec43f7de9dc03ccbdf34dbd5cd6
SHA512
7541ec0bb63db337123785378a6bba14c89bb43c65ef5233cf3a9d1289caee561c597562bad602b398fc3a14f27c560770edc51b6b1a371a44026e3ea1e4566a
SSDEEP
768:IykIwePd8g7dH2R9pOsvzaVCzQqg/SfW1zJj/5A36NecFaupFXIEw:IykzkagURHORVCfupp/5A3eecFaw2
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
1b7c7dafb81417f9992354736783703e_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ