CancelDll
LoadDll
Behavioral task
behavioral1
Sample
63864a004a1b7e15b2f6da1df0755cfe_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
63864a004a1b7e15b2f6da1df0755cfe_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
63864a004a1b7e15b2f6da1df0755cfe_JaffaCakes118
Size
65KB
MD5
63864a004a1b7e15b2f6da1df0755cfe
SHA1
b02fb1c1246ce573785fc3ea62a5b91fab2a9a70
SHA256
bfd71cdea41d99c0bbc122a507646c01b4da4e1e38f56e8e1aee535c62ff642c
SHA512
6fd5bb57adaa94e3edeace4fbae62b314b3d29e60f3535c40785d665574fcd86462641d92266ac7ba76b83fdcb313ba1e6df0e28a3261e7ed10b76aeec5618ad
SSDEEP
1536:Z6yEOWXF++I7FkK7LUdjZmjw829jNSDOw77wY13P/+XUWdcPyRxQC4P4:Qc3+IN4djgiM/L1/YUjyRxQM
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
63864a004a1b7e15b2f6da1df0755cfe_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ