CancelDll
LoadDll
Behavioral task
behavioral1
Sample
29f3d15f15d81858b2a5b91ebd1086d8_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
29f3d15f15d81858b2a5b91ebd1086d8_JaffaCakes118.dll
Resource
win10v2004-20240704-en
Target
29f3d15f15d81858b2a5b91ebd1086d8_JaffaCakes118
Size
57KB
MD5
29f3d15f15d81858b2a5b91ebd1086d8
SHA1
b72e9b4e49694191a1bbfd32b261603487585ae2
SHA256
9c8310652d4c773be6188446fd5dfac9e15fdfecd8ddac7e44b84ed551fd1bc8
SHA512
55fb0a56bfe0ff6ff742dc6d084797f2af45716e2867d45c1da3250f48c4ac4c25428eb492b8b14edef90ea83e7906d14db4d29727bbbe3bec63fc33232d806d
SSDEEP
1536:lTD+K/8sP/CcTz6HuG/3Pd/L8tYYGnTMYMWun7:l/tksPpnRMxL8t9WTu7
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
29f3d15f15d81858b2a5b91ebd1086d8_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ