CancelDll
LoadDll
Behavioral task
behavioral1
Sample
5d23dc5eaa6c98be78b85aa01a8d7706_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5d23dc5eaa6c98be78b85aa01a8d7706_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
5d23dc5eaa6c98be78b85aa01a8d7706_JaffaCakes118
Size
62KB
MD5
5d23dc5eaa6c98be78b85aa01a8d7706
SHA1
c388ff226282ed02db20b483afe7263c84f19014
SHA256
a9add052056bffb34e3f5d7445f8ce2f42cf20226c78d8b4d5dc2a80b26f0d65
SHA512
f8128c9ea61c49c4059697e37cc219ee20d9745d2d6f175c147bf0722ac7d7b1c9dbf84d83720894593669701444a85fb7a2e43d824e4c51b37fe9acfe92e513
SSDEEP
1536:Z6yEOWXF+L4yM2tsPWVO7OtPppgmCyP3LzOPQE6d:Qc3kyMBUprfPbzOo
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
5d23dc5eaa6c98be78b85aa01a8d7706_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ