CancelDll
LoadDll
Behavioral task
behavioral1
Sample
35e5ce2a253aeefacb8953fd2d506205_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
35e5ce2a253aeefacb8953fd2d506205_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
35e5ce2a253aeefacb8953fd2d506205_JaffaCakes118
Size
63KB
MD5
35e5ce2a253aeefacb8953fd2d506205
SHA1
1b085fe0033814d57f1984099300c3b9fac7723e
SHA256
8648ebde5d5a0f48ba9902f42e59c727e55d5c7c91881175bfc536a5006e2ef7
SHA512
de24aa7b2c6c5ae98d6f450f9f5a54a6db526bf383bb3c6d6f84003352af51e59fa72594446dfc6cc9fed823aa97d2ccb137f16d1e74364d7ae37af3ff14b69c
SSDEEP
1536:hXGa7ReQC1WrgiB98r20liGAoDG6qELc5MyBh:r7RCUN7Qpe7MLcp
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
35e5ce2a253aeefacb8953fd2d506205_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ