CancelDll
LoadDll
Behavioral task
behavioral1
Sample
77a5f5013d323317c5f483e5543457ce_JaffaCakes118.dll
Resource
win7-20240704-en
Target
77a5f5013d323317c5f483e5543457ce_JaffaCakes118
Size
65KB
MD5
77a5f5013d323317c5f483e5543457ce
SHA1
5006d90704694fe15de3e7f60a6c7d7bbc046b22
SHA256
5148e931094e0270b02d8b48af68c75d8c182e2b3c08f09bc99a1f4581849555
SHA512
08dde39eb560a8ac895ff0e379f3de14682e80338d557edf879583622c414e46e0bb0a9b95b559157bff4a1b5356cf50b586c46c2615e80940259116f2116b32
SSDEEP
1536:NSn+u7vwSzc45QVj/dIdsk58R+4Xn9Pjf11mPKsoyYR/A:N/u3zc0U/mdskC8mj1mPxo9R/A
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
77a5f5013d323317c5f483e5543457ce_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ