CancelDll
LoadDll
Behavioral task
behavioral1
Sample
3fdb3c993a3cf2a3161c6236ff8e5beb_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3fdb3c993a3cf2a3161c6236ff8e5beb_JaffaCakes118.dll
Resource
win10v2004-20240704-en
Target
3fdb3c993a3cf2a3161c6236ff8e5beb_JaffaCakes118
Size
65KB
MD5
3fdb3c993a3cf2a3161c6236ff8e5beb
SHA1
a92828727a72b84c8cc01200740b3f4b7d2f7a8f
SHA256
5ea7105bd7c48c5b58bdb6e46c113cb6a487feb12807854944d051bc61ac4b3b
SHA512
ff9e43739c1ab2dcf16dbca092b09158b8f811e2bccd0b49e2d15f5d29ed404cae63b66b03d363e9b5036d6e0b1ddf216c4fb250e8382947909a08fc9efcdb52
SSDEEP
1536:DWJMe+4fEJS0Wgo9rxoQLO8M1/pUGOMuSOuLGa/5:EMOfEJctLLXSpBuSOuy65
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
3fdb3c993a3cf2a3161c6236ff8e5beb_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ