CancelDll
LoadDll
Behavioral task
behavioral1
Sample
72f31d79d357cb7f376cfa631c928ef7_JaffaCakes118.dll
Resource
win7-20240704-en
Target
72f31d79d357cb7f376cfa631c928ef7_JaffaCakes118
Size
60KB
MD5
72f31d79d357cb7f376cfa631c928ef7
SHA1
bdaaef337a49265e79815b136b1b541c0b0792a2
SHA256
0c877f38e961a3ebf3322a725eafc6b1ce1add6cbfcdcf3ffba9beb15fddd811
SHA512
1a2d2c856abd888a4d1b24ea11045f5b3dd02c2b04c95358073bdece30f3d3bebddc2e9374cc3f849c245d83474e6bde3b92e770b4074937beb72ac0f9be2cff
SSDEEP
1536:IykzkagWlelwMP70Xk4yV3T7f5ReBJJ/7f:IFzka+2s0Xk4yVD7f5i7
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
72f31d79d357cb7f376cfa631c928ef7_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ