CancelDll
LoadDll
Behavioral task
behavioral1
Sample
4bc01a9d28794baf9b6d9a0de1d38e59_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4bc01a9d28794baf9b6d9a0de1d38e59_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
4bc01a9d28794baf9b6d9a0de1d38e59_JaffaCakes118
Size
57KB
MD5
4bc01a9d28794baf9b6d9a0de1d38e59
SHA1
e6cdfae9857d2c9729135801b178d21d9582ecea
SHA256
58bd7e3bc6fccc8ca19d48e83718f2757fa82403c4e0d2529d2c1e5c98dadf77
SHA512
46f3c2bf2b39604e52adab6d6264fe5d5a007e46351c26d765aef2d206e929b72e49db25cafcc059f1a4c2e2c2dad83f0cfcbb8a248b55f6ad83eda683377184
SSDEEP
1536:mtKxbweCZ7THaaEfwm+EnsMqRCZQNbBpeqbV:/krP6aEfwm+EsXdBpeyV
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
4bc01a9d28794baf9b6d9a0de1d38e59_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ