CancelDll
LoadDll
Behavioral task
behavioral1
Sample
6530b4bd9cff929707b4668ad1a9b3bd_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6530b4bd9cff929707b4668ad1a9b3bd_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
6530b4bd9cff929707b4668ad1a9b3bd_JaffaCakes118
Size
47KB
MD5
6530b4bd9cff929707b4668ad1a9b3bd
SHA1
61f1de63540ed52079d8257b0632257c1e6fdc93
SHA256
7f2089f8490bf37b05e98183948169e564905d93002d1f3e813bc0f3a96b2fbd
SHA512
e7495e5f21684825d4764342b3cb386c5f767eda6a9ce65eceff0f68ae30e1abec1a6e922100e0f874e4a7f1edfab1fec5edaa49f2c8d1ee9a1a06ab1900f5d5
SSDEEP
768:FPUwXWaTfRELlWCPtZSE9NxfjYICwbF7aU5K/2cEz0JY4:hXGa7ReQCSE9NF8ICwbFja3EzwY4
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
6530b4bd9cff929707b4668ad1a9b3bd_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ