CancelDll
LoadDll
Behavioral task
behavioral1
Sample
3b25b80614a750701e18c34c1c498368_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3b25b80614a750701e18c34c1c498368_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
3b25b80614a750701e18c34c1c498368_JaffaCakes118
Size
63KB
MD5
3b25b80614a750701e18c34c1c498368
SHA1
665ac66a98fa5f4d8188989d4777b3c56a03c6e1
SHA256
bcd591f3d90900905e5f2dc47fff260ad9c3b4f64008eb0f2b7c1dadcd9eab49
SHA512
799b47ab32001cb7f8a213f36544ba22da27ea8f842e7a519a690db56c3bb111f0c2cb8e36cef88465a9dcd3bbe8f96310a912c45147d58c5e0580c07450ea85
SSDEEP
1536:Z6yEOWXF+Gwg9916VKH3qrVGA1BEDKeDJWzJo1BVALFxcH67a:Qc3Gwe9MV03qpGSEDlJkJnFxm67a
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
3b25b80614a750701e18c34c1c498368_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ