CancelDll
LoadDll
Behavioral task
behavioral1
Sample
6657038edeb1047b4d1daa2772ef8006_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6657038edeb1047b4d1daa2772ef8006_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
6657038edeb1047b4d1daa2772ef8006_JaffaCakes118
Size
56KB
MD5
6657038edeb1047b4d1daa2772ef8006
SHA1
f2eb7a6e0b1e31bdd3b80c1a0b51ad4397fe8d40
SHA256
1ca33a0d125298402fda641fc103de51b53603099d9b1cad432c433a4b48e03d
SHA512
85994d70fdffb2b2f5b6f972797e8ac0c0cd0065b13caa480ce2dc1fef67522b08982211d107675374ac81cf411408bc5041e5a5edec4c943599ac5c8a0d1fb0
SSDEEP
1536:+gK4oX3t1BAE+wpPEmenOUjR5jnP90lhbCZjqQi:i4CxAEbAVXnV0zLQi
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
6657038edeb1047b4d1daa2772ef8006_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ