CancelDll
LoadDll
Behavioral task
behavioral1
Sample
2c7e7afdd62b7ed9d49778c9d8aa3687_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2c7e7afdd62b7ed9d49778c9d8aa3687_JaffaCakes118.dll
Resource
win10v2004-20240704-en
Target
2c7e7afdd62b7ed9d49778c9d8aa3687_JaffaCakes118
Size
50KB
MD5
2c7e7afdd62b7ed9d49778c9d8aa3687
SHA1
f6e7aa577f54ce90f336609e0d0f237ed01971b8
SHA256
d3bb8cc3cbb9e2c0424026fcf2e47168dec9818dd6865c255906e9f2c55a8a16
SHA512
09ba0c5f9ba9e52120aa26aab039c80dcdf723ff9a8e34ab3e4f0409cac1344fe7e0e3d501dbe4c5843ccf26771db51a6540e6d7b489f59462848a748662daa3
SSDEEP
1536:hXGa7ReQCzkDvBPqzleut2i5cMcpTOWPzREC:r7RCzqat2i5bcphPzRP
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
2c7e7afdd62b7ed9d49778c9d8aa3687_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ