CancelDll
LoadDll
Behavioral task
behavioral1
Sample
258b97e65c3addf513d45cc06b80a73a_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
258b97e65c3addf513d45cc06b80a73a_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
258b97e65c3addf513d45cc06b80a73a_JaffaCakes118
Size
45KB
MD5
258b97e65c3addf513d45cc06b80a73a
SHA1
41666c67de2aa624dbd5fe20395ab85c9a25daaf
SHA256
e1eb1b1d8c2ed53220ca9673cfcca1b1f2eb70bcbb0337f1327f68e3869820e2
SHA512
66fcbd959b3f98e27b37572367658996a00e41e1f1e70c752d55e297929b1b0aeeee0e74aace6a6b8452f6d9d9afa9272789110d10645d7c6277ff7496cf3ea9
SSDEEP
768:RYbEeEgcrb3OZ7q9l2k7sfcbBfyNKq6pmr39tnJOxPPYLBSlK:RYEv6efze2y6pmD9p0ESK
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
258b97e65c3addf513d45cc06b80a73a_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ