CancelDll
LoadDll
Behavioral task
behavioral1
Sample
829ff30dd5e95596251bada340699b91_JaffaCakes118.dll
Resource
win7-20240708-en
Target
829ff30dd5e95596251bada340699b91_JaffaCakes118
Size
67KB
MD5
829ff30dd5e95596251bada340699b91
SHA1
14e28f6717dd1e540504c81b8747c1c5d89f364f
SHA256
2e678c47a2d6ef88339d7ae295d65f0f0f4d94db4c33e256a2bcbaec95f5c621
SHA512
a531b7cece7d1c66ab9f361f4f49256557d152927eda9db44ee52920e9a1a10dca650ad27f963288279204338995823495925cbd13db02038ab7f6cf0cd1b76e
SSDEEP
1536:R75r0mvyWk6omKdDQQmBt8R4hbpq3TEvhfqml653FtRKt:R75r0mpkLmK9g6KppITQBoF7G
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
829ff30dd5e95596251bada340699b91_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ