CancelDll
LoadDll
Behavioral task
behavioral1
Sample
3dfdce49426c509761121b6227b8bb5d_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3dfdce49426c509761121b6227b8bb5d_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
3dfdce49426c509761121b6227b8bb5d_JaffaCakes118
Size
71KB
MD5
3dfdce49426c509761121b6227b8bb5d
SHA1
4b08040f871c78fc37cd444abdb38b94cbeea3aa
SHA256
c1bf205573b29a6cfa17d7caef86c5d2f19d4509a94b0e16ab3f6f42f8074bcf
SHA512
c34a5e2473e7594fa8498ea349ac062d0251666bce899ccd569c56b51778271ef7d1f133041509c034196e8adaccb86f5caa4873bb0bb1a3684187476b25d299
SSDEEP
1536:lLTer/00I3AlryGkhoYhrenyVx/tCKSwN5AXZ2d87psni4GoE0jA6:FTeoT3AwGsG6xMKSGawdUarGEjA6
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
3dfdce49426c509761121b6227b8bb5d_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ