CancelDll
LoadDll
Behavioral task
behavioral1
Sample
46f8a3861fe6ae9cbd320edd065a9e23_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
46f8a3861fe6ae9cbd320edd065a9e23_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
46f8a3861fe6ae9cbd320edd065a9e23_JaffaCakes118
Size
57KB
MD5
46f8a3861fe6ae9cbd320edd065a9e23
SHA1
b963615b572883bf7e8b235a37a84125391564be
SHA256
630d907ab97bd9b38548f5a0de7b2d26fa92abe15a71dd594b56dc150efa1ca2
SHA512
a05a26ea6f8bf147090cf1d3709c6583680c1f605d45ef1841e84e853f10cd5f6647632e83377cbe6b5d3cafbc6bc1c7100e3fb5415b008c73af2126717bb709
SSDEEP
768:IykIwePd8g7dHfRIfXqWfko8tvNx8Ki5xj9TPyr3DMNLa7A8NRhz677AjqAFfKQw:IykzkagOqs8JQH9TPFes8Nf+YkQdi
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
46f8a3861fe6ae9cbd320edd065a9e23_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ