CancelDll
LoadDll
Behavioral task
behavioral1
Sample
6a4c4852c824f44b2fcea1f6cba3dfd3_JaffaCakes118.dll
Resource
win7-20240705-en
Target
6a4c4852c824f44b2fcea1f6cba3dfd3_JaffaCakes118
Size
59KB
MD5
6a4c4852c824f44b2fcea1f6cba3dfd3
SHA1
aef0c3d470656acbc083f07a53e08e444ee2184b
SHA256
39a4e9a94b7bd303e3390440863edeb47a439ae573c5f48e734cdadcdbfc6312
SHA512
c8fdb3d00a5bda160f94e94e27b587942bbf2594fbdf5b5f1c8cf7aaa738108bccc8f3124276722b004f60b3b5055fce8e98ed27d17da6dffe4fa4cecab1f83e
SSDEEP
1536:lTD+K/8sP5lB1zfH0pnMFvU0wPOG4WNyyKlxvliXd5:l/tksPrfzfXFmPF3Klx9iX
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
6a4c4852c824f44b2fcea1f6cba3dfd3_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ