CancelDll
LoadDll
Behavioral task
behavioral1
Sample
782fd87a9cf0a3b4a7e8694b2e175d36_JaffaCakes118.dll
Resource
win7-20240704-en
Target
782fd87a9cf0a3b4a7e8694b2e175d36_JaffaCakes118
Size
53KB
MD5
782fd87a9cf0a3b4a7e8694b2e175d36
SHA1
73386f82ad912cb1d4f6726c9769e23e0430b9bf
SHA256
3d1ecd652c612041d9c694556de74dc1f27d837e2eea75da0ab4a30b65708176
SHA512
1d5299c0b175cdae12e3cd62f7639bd4692645d4d68a8827f471cae982b1ef959650059b11b61334d7b253839e9ea6ee241edaa6b6500f33c62c089ea94b2867
SSDEEP
1536:QkywKq/ttusjrNHin8/1OQWgUudpyU6jTV2kdD3:ZP/CkHk8NygUuOJjTV2kd7
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
782fd87a9cf0a3b4a7e8694b2e175d36_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ