CancelDll
LoadDll
Behavioral task
behavioral1
Sample
2cbd2f8f8cfd7b8c481779893525a068_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2cbd2f8f8cfd7b8c481779893525a068_JaffaCakes118.dll
Resource
win10v2004-20240704-en
Target
2cbd2f8f8cfd7b8c481779893525a068_JaffaCakes118
Size
68KB
MD5
2cbd2f8f8cfd7b8c481779893525a068
SHA1
67f8c6e5b6f241d425809c02939b4f044130a024
SHA256
c17c532278c772aa820bd1d50cf5e39d0b97cf434d3cdc5e6f083f8a351e1962
SHA512
1df030d42cb6f9352c76c43d1848858d474d48abd2ff36135e4e6d9fcdaebcd096768a86fb3a55ee21c4f33849653d5213a70c2471820795ae2eeafc02bdc687
SSDEEP
1536:Z6yEOWXF+WEHCKFksBjyrMU9b45SoevQRBuOjAtYMveT:Qc3WEiqHZyrMD5OoRsOjAtPeT
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
2cbd2f8f8cfd7b8c481779893525a068_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ