CancelDll
LoadDll
Behavioral task
behavioral1
Sample
783760da505ca46b814db5aa56e55f8a_JaffaCakes118.dll
Resource
win7-20240705-en
Target
783760da505ca46b814db5aa56e55f8a_JaffaCakes118
Size
55KB
MD5
783760da505ca46b814db5aa56e55f8a
SHA1
e4a75e49ea4a3e086eebb3c62e61753e8d411457
SHA256
45103f437f2cf730401aae537ca06c00b384bef0011497434ca85b6270605c63
SHA512
303b2aee98084800392c9526928615fe1bed111dc2d0a99565b7af7813332c06f4c3cc3b2228496853021d21ea1c3f119be7fb8686777903c3f86950aa0015c3
SSDEEP
1536:+gK4oX3tthwN7eYLhBCXmbU2c4Hsoek+ub:i4CXhwN7VhIX2GHub
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
783760da505ca46b814db5aa56e55f8a_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ