CancelDll
LoadDll
Behavioral task
behavioral1
Sample
5e31c4bb4680345f9d50d8c3c63e4bba_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5e31c4bb4680345f9d50d8c3c63e4bba_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
5e31c4bb4680345f9d50d8c3c63e4bba_JaffaCakes118
Size
75KB
MD5
5e31c4bb4680345f9d50d8c3c63e4bba
SHA1
02b99c8dfb5f4b445db00f7482ae8a5bd465572a
SHA256
52d89d5259e43eccba9a246a505736cf5707f6a49f84167d310fb1eecbcf4f4b
SHA512
eb902608110283ac4ea7a3acef356a291322c5274749367559b1648644ccfa474494bee3059a899ea63de22a83dd81576fe7a6355fa17fb8b4f26de354a65cb5
SSDEEP
1536:lTESkEqKIri5P2ZYWZcqY266Z9Hb/nn13ysL/LlZiAJPPZWZKjBehTyJby:6SBk0PNWZJY26mHb/nYsLLHJPZ6gYhTr
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
5e31c4bb4680345f9d50d8c3c63e4bba_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ