CancelDll
LoadDll
Behavioral task
behavioral1
Sample
35916dea658143808d51d1f0d473b22b_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
35916dea658143808d51d1f0d473b22b_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
35916dea658143808d51d1f0d473b22b_JaffaCakes118
Size
79KB
MD5
35916dea658143808d51d1f0d473b22b
SHA1
9c6602fbcf6dd16d3c93f6ee7fac36890ab45139
SHA256
b4fcdc55ff536a871110cf00420fcfa313df8715db7f4d7c217a2bf169af1ebf
SHA512
fbfd795ba262d2ccbc8d584fb796dcdee20756cf1c7d051484303747b9ccddb71968287b00062309af13db03a07124c38ca1fdf9b241d217db4198372df48ae5
SSDEEP
1536:n1P3M7oe6wdFD64eAMtvrs5BcD4FTYYuG+EkTt9kL+t8uF2d:n107D6EDVWvrs5S0iYz+vt9NtQ
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
35916dea658143808d51d1f0d473b22b_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ