CancelDll
LoadDll
Behavioral task
behavioral1
Sample
827f483d045a0967796332f9b6ddc8e2_JaffaCakes118.dll
Resource
win7-20240704-en
Target
827f483d045a0967796332f9b6ddc8e2_JaffaCakes118
Size
54KB
MD5
827f483d045a0967796332f9b6ddc8e2
SHA1
7010d43c76e7fab2e2716940eee451f25a703d17
SHA256
dd620eac8d431e623238ddfb053ebb87e73973a1098d2f09fabaa2846fa41996
SHA512
9bde0ad7c42b353c917ee9fa18cb0e45c065d7e36965f664ed2f4b9b2140bd0e91cf26f4ce094fd9d3ff6c3b8d302390efcb39103e9a5d1856d4453eae07943b
SSDEEP
1536:9HF3cPoVhig5Tg5uV3wCiI3E4HeABGRcSnPsm:/3cPoVhia6uq1b6GRckF
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
827f483d045a0967796332f9b6ddc8e2_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ