CancelDll
LoadDll
Behavioral task
behavioral1
Sample
670094697b8314ed2c78be3ae8c02031_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
670094697b8314ed2c78be3ae8c02031_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
670094697b8314ed2c78be3ae8c02031_JaffaCakes118
Size
61KB
MD5
670094697b8314ed2c78be3ae8c02031
SHA1
32659a75901ca0ca30aef26b81fca942bccd9b9e
SHA256
2d6c13498c49a234469f84670d141dbb31b64b1940761eb632acdbc456c9ed1c
SHA512
1d9814d9ef5aef2e9546a72a5b2687ff71b7536ff7f1b3e2d79325400b990bda691a3d0b6d38bc5403d36c76795603737220e80b114d6852aaeb22089c6a8cfd
SSDEEP
1536:knK0jhOKw+LzzesXcAGjBHDomI28m6k5nJzbov2hj:knNhOKw+PzesyYPm6cBbov2R
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
670094697b8314ed2c78be3ae8c02031_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ