CancelDll
LoadDll
Behavioral task
behavioral1
Sample
28185a8037ba4e79b7b2c1dfaef2912c_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
28185a8037ba4e79b7b2c1dfaef2912c_JaffaCakes118.dll
Resource
win10v2004-20240704-en
Target
28185a8037ba4e79b7b2c1dfaef2912c_JaffaCakes118
Size
65KB
MD5
28185a8037ba4e79b7b2c1dfaef2912c
SHA1
d6d5ec2c14d9e2f92e59fdd321c75cff02a4cb13
SHA256
e427d1b4e04b717776410c12b3eb4fbdb395344f0ff4a633ea98da3a2ffa2b27
SHA512
34dfa9e5ba0c71672e8852e98168538267693f8651b892291b069fa28c519c737b466ba2d2003e217f57ea2ae26ac1aeb6e40427493b48ea4bda9759c8f7678b
SSDEEP
1536:9f9AnBz3Fgay5jUZ3D1PfzFPQRxPrsF2eN1laKmbWIaRITHe:N9ABz1gay5jUZTVz5fNKOtcHe
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
28185a8037ba4e79b7b2c1dfaef2912c_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ