CancelDll
LoadDll
Behavioral task
behavioral1
Sample
61fc3bd4558304a6a21bc467d9f1ccba_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
61fc3bd4558304a6a21bc467d9f1ccba_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
61fc3bd4558304a6a21bc467d9f1ccba_JaffaCakes118
Size
65KB
MD5
61fc3bd4558304a6a21bc467d9f1ccba
SHA1
96c6975f3c9eba1283a63d241ed9256edbc77a86
SHA256
efc342fc2a3bb483cf059871d7f3fcd346daca2701fe1c13110ae2b80e6c3a0a
SHA512
3e6e58f99bb305a9780cacee76c36c5bd341b9dc98ab249be925a3d07f7dd4acfe039fcada45dbf8e989485be85775304637aa7ba01d038052ee96d9a31f1024
SSDEEP
1536:NomNZnI+CQSrN3Nvn+0YCeS1t2trohFKoqv9jF/yMoE4RRyM:NooC+CpP+fiBehv9jslEORyM
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
61fc3bd4558304a6a21bc467d9f1ccba_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ