CancelDll
LoadDll
Behavioral task
behavioral1
Sample
6ac23aac2989ac53ab80da5672f1c1a4_JaffaCakes118.dll
Resource
win7-20240708-en
Target
6ac23aac2989ac53ab80da5672f1c1a4_JaffaCakes118
Size
70KB
MD5
6ac23aac2989ac53ab80da5672f1c1a4
SHA1
0328c806fd20424e5f2c5b55277f60e31e45c3c4
SHA256
8e8a90d5c57dc4405615301f6d703860e832a5af7608f895fe18d33b2928aa37
SHA512
d8b953ece9bf6e2a29e72eef4001b70f8318ed06f57004da9cecd6a1405baae4bc98c82254b906ea66a6a4cdbdfb097335b18f87c65e73fa9c5497e7290821db
SSDEEP
1536:HAHM1XZ5Wh5q8IrMeyPzzCh0GKF/TyN7VWpNQZC6YCCvH:QMr5WnqcPz00DIUp2ZCXf
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
6ac23aac2989ac53ab80da5672f1c1a4_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ