CancelDll
LoadDll
Behavioral task
behavioral1
Sample
5dfc39e14540b31ee99cecd80de962fe_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5dfc39e14540b31ee99cecd80de962fe_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
5dfc39e14540b31ee99cecd80de962fe_JaffaCakes118
Size
64KB
MD5
5dfc39e14540b31ee99cecd80de962fe
SHA1
60794d75e5c671a1801ac2cec1a2e616903b1d82
SHA256
3d0a0c338bd387d29dd70b57e926968c90e9c9fe122767540d68d1998efab1a6
SHA512
7690712a44c5de3eff2f887335de05515cd12a5868f65e98cfe63475a02fdea3d7109c398a6cc9143482c71ba7ed7e97ca77d0e123ababa0bf373ea3830a0bcc
SSDEEP
1536:DWJMe+4fn8W65IHivamh7vMzuZACHOX3FZksEbf+KpOv:EMOfn8bICfVMzgZuX3ZkzpOv
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
5dfc39e14540b31ee99cecd80de962fe_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ