CancelDll
LoadDll
Behavioral task
behavioral1
Sample
84c66f14de8a2d213ca0df76c905f3b8_JaffaCakes118.dll
Resource
win7-20240704-en
Target
84c66f14de8a2d213ca0df76c905f3b8_JaffaCakes118
Size
69KB
MD5
84c66f14de8a2d213ca0df76c905f3b8
SHA1
7e4f97c4fea7f05c05c23c9397c01a4ac62def16
SHA256
74aae8e048f6a7e61f7504dbde31d7ba0580af8206195c44f984963db0cb344c
SHA512
cdae99f6d03b39a1a4383b70554b275b16a50a18ada9e55328f7d668494e231d5305aaae59e990bfdf3a46a2db21a80199178d59ce5637d0eb3a20bf20ea3fea
SSDEEP
1536:Z6yEOWXF+Ad5PKX+EtReWH6wBLH0bADa2HleVGfQbFuX5xN:Qc3AdhKu+QG6W7raklSGMuX5b
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
84c66f14de8a2d213ca0df76c905f3b8_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ