CancelDll
LoadDll
Behavioral task
behavioral1
Sample
76e45a550b613eb50a047a1127a88808_JaffaCakes118.dll
Resource
win7-20240708-en
Target
76e45a550b613eb50a047a1127a88808_JaffaCakes118
Size
66KB
MD5
76e45a550b613eb50a047a1127a88808
SHA1
1d6fe31da1ca38ca2325999a279748f14d9cf14f
SHA256
da579e3b7d6e1a0337988cbde5c980949466f964390a61212882f58b883b4d99
SHA512
c8599dc1d4e58ee1a646e46e961eb0cee3424adc6f1376d335b7740e622ddab4619c34462f4c45a205a11c12ef5fb0ca8e4acd366e2d70bbc62864bd4b46c58a
SSDEEP
1536:hXGa7ReQCtMj1dcDlA8OhrI/he+ziiv88jNCHQRoRXQQb:r7RCqBaDXsmhe288j/uRXQe
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
76e45a550b613eb50a047a1127a88808_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ