CancelDll
LoadDll
Behavioral task
behavioral1
Sample
70dcdf085c3b8c6bfdf38ae8f6b80588_JaffaCakes118.dll
Resource
win7-20240705-en
Target
70dcdf085c3b8c6bfdf38ae8f6b80588_JaffaCakes118
Size
58KB
MD5
70dcdf085c3b8c6bfdf38ae8f6b80588
SHA1
c07c3e272ddaa25923ff6fae430d86809516aa82
SHA256
2dd8b904660ad5a98882fe0bab7840fb60e80f680f76b0c038502f7dab63128f
SHA512
097a8e7fed82fc221ad28800f5fac239bcb4611a5470bded21d2eabfe881b8924d85fed25a8fa5cb3040bae6c881943ec5b0c142e254b415d16668e2b5ee2bfc
SSDEEP
1536:IykzkagjFet3R7Z9qtptkNth09yKxGXG/:IFzkaQFC3RFUtmi9yKxgG/
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
70dcdf085c3b8c6bfdf38ae8f6b80588_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ