CancelDll
LoadDll
Behavioral task
behavioral1
Sample
61866807e6edcb8c9832bcb04975ea1b_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
61866807e6edcb8c9832bcb04975ea1b_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
61866807e6edcb8c9832bcb04975ea1b_JaffaCakes118
Size
55KB
MD5
61866807e6edcb8c9832bcb04975ea1b
SHA1
000aa0f3c344381d63bb4ae7400ca678c720fa39
SHA256
3d4cf290eb70605a75d8317f3799ee1f8a0ffd4a2f1a2cdca56230fbcbda4f43
SHA512
6976e2a862ceab048df418cc66ffb73223c6f9407c3e4006ced39ea40e0c31bd4d694f38849d1026f838a55778adc8af0fe1fc3f5f667a4fed1c77938d2c2eff
SSDEEP
1536:NomNZnI+CQSrNisbUKQRFBPtTyiENgyN/DtKebM:NooC+CmsbKHBP2KyFM
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
61866807e6edcb8c9832bcb04975ea1b_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ