CancelDll
LoadDll
Behavioral task
behavioral1
Sample
2c944d64291f0cd308d9cfcb9e771f89_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2c944d64291f0cd308d9cfcb9e771f89_JaffaCakes118.dll
Resource
win10v2004-20240704-en
Target
2c944d64291f0cd308d9cfcb9e771f89_JaffaCakes118
Size
82KB
MD5
2c944d64291f0cd308d9cfcb9e771f89
SHA1
158ff252c4a511f2ccff368542463aedd41a7cab
SHA256
9e0347d2041b609d5866bf734fe01be901f89767fe2c8b6d2e07383ba8768164
SHA512
79acf4643bee470191a44904ca95b862594ce27390b00141cbda6d040d5e28c22eaf01cbc2cec3b6a416a7143fc8d35c3d357cfd42451af6b87cf6d12bc4c78d
SSDEEP
1536:hXGa7ReQCxanD6BZAwzAJN1rey4tPQmqh49mi+K7Ni3ToPl/X9Y:r7RC0DUZpAJyQvYmiBiollY
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
2c944d64291f0cd308d9cfcb9e771f89_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ