CancelDll
LoadDll
Behavioral task
behavioral1
Sample
8297af2a0270c680a3be8a7d93785740_JaffaCakes118.dll
Resource
win7-20240704-en
Target
8297af2a0270c680a3be8a7d93785740_JaffaCakes118
Size
55KB
MD5
8297af2a0270c680a3be8a7d93785740
SHA1
242e9e56942b8851c9f586c204baeeac16ae7e9c
SHA256
cd749c2c83621f72c8e387c7de177592f6e8a0e18a481fe574c0d9983e820411
SHA512
4248eb479fb6a5d50f8dd47e1707a14158d78ac86626c51ab582747ac716cd4e837129e2fc3248fbabac980d61909870c7f26d45087e3decc448f909eafca9da
SSDEEP
1536:n56EgII/EjzrITh+f7ptBN2CHYqFQvmbdt:n56Bn/ezUTh+DDBECHYqy+f
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
8297af2a0270c680a3be8a7d93785740_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ