CancelDll
LoadDll
Behavioral task
behavioral1
Sample
31fc988776de37b0a8c1697c00536291_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
31fc988776de37b0a8c1697c00536291_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
31fc988776de37b0a8c1697c00536291_JaffaCakes118
Size
53KB
MD5
31fc988776de37b0a8c1697c00536291
SHA1
18b43ad54ce5cc6606e0cfaf4f4e9d88c04fd31d
SHA256
d6cbc64f159a60db3ec814d548a55eefe217192efd855fc359d1ec63a2cc2c26
SHA512
648f0a9206850fb2d23c9a895d7bf9e51cdddcabb133d125bd06f6d16ca3a449966284fd6e79192a0bbbc0ec6ab285489ae1be1356bc022bfa6fdaaa3f260d22
SSDEEP
1536:MtGxxe/81mE+DooLYWA70EwfNuv72QtKS2pr4kDH:MtGxxeU1mjDo+PuT2QtKVVDH
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
31fc988776de37b0a8c1697c00536291_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ