CancelDll
LoadDll
Behavioral task
behavioral1
Sample
5e5f549b29826ab595f8c4e080004442_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5e5f549b29826ab595f8c4e080004442_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
5e5f549b29826ab595f8c4e080004442_JaffaCakes118
Size
60KB
MD5
5e5f549b29826ab595f8c4e080004442
SHA1
255e739312d3bd9176deaf5a0bae219ec0022a01
SHA256
97e40946a8c43344e65f057856e818f76ee1df1fd4f6bb8140e61faa4e5a8f5d
SHA512
e43518e9d1e09ddf84fc5836eea6991e2f6d8ae715838498d0d57956f3a8cf26e7da31ac630949d20e08ff2b8c3176ced8a32e8f6834f5d9a098f8223351127e
SSDEEP
1536:6hoJnwF/j1748PFY99efnY/JZ5cEiLqQ1PAk2K:6CwF/J7ZPo9AgJ0EiWQlHf
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
5e5f549b29826ab595f8c4e080004442_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ