CancelDll
LoadDll
Behavioral task
behavioral1
Sample
285e0cda0f0db9a876f3e4d71401d276_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
285e0cda0f0db9a876f3e4d71401d276_JaffaCakes118.dll
Resource
win10v2004-20240704-en
Target
285e0cda0f0db9a876f3e4d71401d276_JaffaCakes118
Size
79KB
MD5
285e0cda0f0db9a876f3e4d71401d276
SHA1
b7c83fe3c6f0405c90585a8c0c55d922bdc668e7
SHA256
654661cbcbd76a0deb518c536e00514cf095b28010d99c0998037a35d7065781
SHA512
eca912f60e2f93ce0c2cdc6b9b0e12fa6a5c2efd1e2c1c1f37f631bd8da068941eb6b4958aad4198cc01d65c7c54ca019740e335084c98d71cd31392aa2fe1c1
SSDEEP
1536:hXGa7ReQCV9lZL40glccUihQffpfFEUxDWlk77XRXL1gFbNHSno:r7RCV9ld40gacqpHxDWC9XL6TSno
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
285e0cda0f0db9a876f3e4d71401d276_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ