CancelDll
LoadDll
Behavioral task
behavioral1
Sample
702a99a6a1ca48d7dd0323af26061247_JaffaCakes118.dll
Resource
win7-20240708-en
Target
702a99a6a1ca48d7dd0323af26061247_JaffaCakes118
Size
54KB
MD5
702a99a6a1ca48d7dd0323af26061247
SHA1
37eac262dd5b126064ac1c571132bf7fc171a4b8
SHA256
e5267da63de69f8b2121d46e281001feae6b21ad04b92a3caaae3816ed576c92
SHA512
e4430e300e849e49cce34f6a729c7a5c20972a05482a54e1e92127a4fde1f0bcec4b527bb7dfc74e91ac13cd648270f4f3b9ecd5a2f6e0a3124b74b8cfcd21ad
SSDEEP
1536:DWk6xzNgxXA5iujaNlrhn43cfRkIbBl/MFCMI:SVsxwAZNlp4sfR5bMFCF
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
702a99a6a1ca48d7dd0323af26061247_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ