CancelDll
LoadDll
Behavioral task
behavioral1
Sample
62c2e5b808d089602950b3ad02199a95_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
62c2e5b808d089602950b3ad02199a95_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
62c2e5b808d089602950b3ad02199a95_JaffaCakes118
Size
58KB
MD5
62c2e5b808d089602950b3ad02199a95
SHA1
8470dbc97577560eecb8f58a5e4a6ce784e174be
SHA256
bf9890f4a239a8cea9120fcbd272e6066f2892da237797c78c5380db4f1794eb
SHA512
e0ed2e6b80942d1badbe200f5b6e8701815c26555b5eaaaa129f752dd77500bd2c6b4aa3a69c26dac2e42287a94f5348e3462e58388d2eb28e4d86e649f35dc9
SSDEEP
1536:wdWZSX7NvFHaOxgyUkY5Eh2QbuqGZjuUMtaeGpj8XW:wdWUrH9gyJnsgxGFuHvGJ
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
62c2e5b808d089602950b3ad02199a95_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ