CancelDll
LoadDll
Behavioral task
behavioral1
Sample
6ab89b90063fa3000014d09ee85d936b_JaffaCakes118.dll
Resource
win7-20240705-en
Target
6ab89b90063fa3000014d09ee85d936b_JaffaCakes118
Size
76KB
MD5
6ab89b90063fa3000014d09ee85d936b
SHA1
b9cb6d7357ad0804b389afd2dc9eaf1ef088be0d
SHA256
dfbf40b8ad67aff30b4eaca3af8e2284ae0af259a75d7a6dc2d5d7b80b191bb4
SHA512
8e7de9c2284b7405452117bda9fb36feda1f0228cb9efbc38773781764cdaf9c14f1634e4dcbf99ebb081f0fcebf10ce772c9d8b0eded25d19c7e4792eec29d1
SSDEEP
1536:9HF3cPoVKBapgWoHHXS3M50PVvHceHE0pSYLLZKS7gtS0I:/3cPoVkMgWoH3S3MefHLSYLLZKS7gS
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
6ab89b90063fa3000014d09ee85d936b_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ