CancelDll
LoadDll
Behavioral task
behavioral1
Sample
367a05ce81b7054ac183a7e356025123_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
367a05ce81b7054ac183a7e356025123_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
367a05ce81b7054ac183a7e356025123_JaffaCakes118
Size
62KB
MD5
367a05ce81b7054ac183a7e356025123
SHA1
baedb097288860cbf76e121eee9d6b533a88e718
SHA256
23263e7cd694645e09023f5b5fc09e557e33236b9e0f10101b72db893ac6aa2d
SHA512
3800aba3e50013ce7cc93e064552943f177a3e9e172502185b2eab74af42b50575704313b3be045d87254cbfc2ceec23250bb8145d261f797526436298019909
SSDEEP
1536:Z6yEOWXF+5qifX7EcLdyFmmQOtYq9cpEnA0UEbEab:Qc35qiP7EcLT8tYqu2dU8Lb
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
367a05ce81b7054ac183a7e356025123_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ