CancelDll
LoadDll
Behavioral task
behavioral1
Sample
6347f08cbcc361cdd82defdc44940ff6_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6347f08cbcc361cdd82defdc44940ff6_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
6347f08cbcc361cdd82defdc44940ff6_JaffaCakes118
Size
49KB
MD5
6347f08cbcc361cdd82defdc44940ff6
SHA1
a60c20f56a0666b8563b5ff814d3c03efc64694f
SHA256
2410ef1f6c7fd93eeba9b7545f315d91dcbb2c5316988ffcfecab2b4836c9f28
SHA512
ac1030ceacb2283608620b01c4c2db9aeedc7bdd7a2c875e44fd01d688f97f81367cabaf2992919b75d3238d61014b54f75cae1481d0ca060af641c17707b8f3
SSDEEP
768:KmQfLqgLbu8zXt29Ho3CtoOKsZ2/rguApsqS9TcWekanlGu23Cd3P7EdY4xf7KEd:58mg/tzoHsCT/xdpsfwWepGu2ydzpahd
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
6347f08cbcc361cdd82defdc44940ff6_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ