CancelDll
LoadDll
Behavioral task
behavioral1
Sample
67550c4f6c0e7a8ef4dff6759406ab19_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
67550c4f6c0e7a8ef4dff6759406ab19_JaffaCakes118.dll
Resource
win10v2004-20240704-en
Target
67550c4f6c0e7a8ef4dff6759406ab19_JaffaCakes118
Size
67KB
MD5
67550c4f6c0e7a8ef4dff6759406ab19
SHA1
9b94375055ee3f0682da715dfb578a7944b50384
SHA256
aed7dfea83b1780e584b267c5c6c6212b8005ec5a3170b6526e29f5620d2e3b1
SHA512
f31f45f4bafc9b4042647489baa57ba6e25ec13eb148c22e3975f149255beb38c40107efdcbe526f02937c73559e171df7650717a77057e54df123704f2d1f41
SSDEEP
1536:rlxKpFLLZLJk8IqLJXfJhiTlGhTUyB9W6QfdvV:30tJDRhPhTUew6QfdvV
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
67550c4f6c0e7a8ef4dff6759406ab19_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ