CancelDll
LoadDll
Behavioral task
behavioral1
Sample
23f8fdc04e30d617ba2be23dbf5d2e0f_JaffaCakes118.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
23f8fdc04e30d617ba2be23dbf5d2e0f_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
23f8fdc04e30d617ba2be23dbf5d2e0f_JaffaCakes118
Size
52KB
MD5
23f8fdc04e30d617ba2be23dbf5d2e0f
SHA1
0333d5c4df0e0ea4c8b0c705903434667d902c22
SHA256
70df34f834d74650826236c67cbe382136fb2f4fbaf2f1d8d04b79f2fbac6aca
SHA512
873234efb4cbcf844acd37274aaad41850cd283e6fc7d827c7466182c33ed87a905e22572afb8754f4cfca4e1c58574078625f6d6c068784674df9f79744080d
SSDEEP
1536:Z6yEOWXF+SBDS3fahB4tp8Z2uiFQZsCfSQjFg:Qc3SdjhBl2u5RSR
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
23f8fdc04e30d617ba2be23dbf5d2e0f_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ