CancelDll
LoadDll
Behavioral task
behavioral1
Sample
83e3a101fac40caf556372b39283397d_JaffaCakes118.dll
Resource
win7-20240704-en
Target
83e3a101fac40caf556372b39283397d_JaffaCakes118
Size
69KB
MD5
83e3a101fac40caf556372b39283397d
SHA1
a3709dd470492b26f8fd0fb7a3710e342474d822
SHA256
b8aa1440e17f28e4d84425d4b5ad317946cbda2e3e31a8fa03c07f4c4191ccd8
SHA512
88993c59fde158f6a3a31cc4c8225236fac022eb7904a626e1e66e6fc4dbea9652e8b060b4d97a0a9398cca57501c4a84e24a20fd0a5dc625aa73d14d16e642a
SSDEEP
1536:Iykzkag5RqrwhpYHxONSgaw+Tsfl8tPLZExdi6oHb:IFzkaPSpYHsNbaw5lmZExloHb
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
83e3a101fac40caf556372b39283397d_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ