CancelDll
LoadDll
Behavioral task
behavioral1
Sample
6ac32e49809a0c5ee5e437c7c74f3aee_JaffaCakes118.dll
Resource
win7-20240704-en
Target
6ac32e49809a0c5ee5e437c7c74f3aee_JaffaCakes118
Size
50KB
MD5
6ac32e49809a0c5ee5e437c7c74f3aee
SHA1
d39377dd6e142c6fae0d567dc0bc05f909215005
SHA256
9c291afddafdcda1fcc870eb12c8b804d2cea0ad6aab2a2389f122674b3058c5
SHA512
c60e74aaaa0e2c1a0cfc4f2c5b126a3e3171b8085e1b06cd1c6dac19a149d4f2d0ff12a0a2ca4caa498ed20a51ac0ce283a34a6c56f61a95e1de44ed8090f263
SSDEEP
1536:x7li0adAjGpdQcRlVf4XiIkStjLMUNda5VU:xBUajGpdQcRgkSOn5q
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
6ac32e49809a0c5ee5e437c7c74f3aee_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ