CancelDll
LoadDll
Behavioral task
behavioral1
Sample
2a4b7d38e1d900ac9d9413ca0bd171e1_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2a4b7d38e1d900ac9d9413ca0bd171e1_JaffaCakes118.dll
Resource
win10v2004-20240704-en
Target
2a4b7d38e1d900ac9d9413ca0bd171e1_JaffaCakes118
Size
67KB
MD5
2a4b7d38e1d900ac9d9413ca0bd171e1
SHA1
468da30f2dcf4edee55a992aedcb6923c40fb13f
SHA256
0d1a61cc99ffabd8a7b4fa788a6d4e2fb54bf0d655f47c36bed212986af1ab87
SHA512
a684fc261f01d95792d5d3577335a3de070b13aa6611714f38a2bd1df3a64bbd94e1cefb380804bbfb38c0d0f03e2d05c10354f1bef98f8461b58876d7c2a0d0
SSDEEP
1536:O/S0+71YKxmOW6NwirhJdCBhgl2hZexj3s++:O/S0+hPEwZtacQrw3S
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
2a4b7d38e1d900ac9d9413ca0bd171e1_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ