CancelDll
LoadDll
Behavioral task
behavioral1
Sample
68ed26f01e7029689a03776d94851256_JaffaCakes118.dll
Resource
win7-20240708-en
Target
68ed26f01e7029689a03776d94851256_JaffaCakes118
Size
54KB
MD5
68ed26f01e7029689a03776d94851256
SHA1
56bd96aa6c71e6faf0202e29a1de6fe145fc72eb
SHA256
5eb843e44993f3d4bf6a4c13d55a0665e64389d9a2aee64557440ee3a17b3903
SHA512
5453913475f2b1572d8b00fe8d4af266988dd25bde9068838804fcf6cb7e4d1c6b8663e7a97d9cb49616ee10d06b25651838b1c1d225843ae132388dcadcf4c0
SSDEEP
768:IykIwePd8g7dHWXqCjPmAf4aD5yRJQAWG8IiEu8DmhbrdPxXf4qBY5d49:Iykzkagk5jJf55yTtqAgfz9
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
68ed26f01e7029689a03776d94851256_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ