CancelDll
LoadDll
Behavioral task
behavioral1
Sample
8515de2556f7142e53fe6820ecbf016b_JaffaCakes118.dll
Resource
win7-20240705-en
Target
8515de2556f7142e53fe6820ecbf016b_JaffaCakes118
Size
60KB
MD5
8515de2556f7142e53fe6820ecbf016b
SHA1
ba64bf8fc4c80c8658c76e072551a854feb348dc
SHA256
13be78b98c8ade28dd8ee6bf7ce854969f6f459f2b3754ce397021981fd8a400
SHA512
03b7317666daf4ef3a6a72bb5decb20f7ab8a56ba1e216d5c2c902a17f654d69dcb72f3ff201b97f30f7a68bed92ab74d1fa4f421acf63d58abbfbc736e8f9fb
SSDEEP
768:uCOzB/iH5iewIb3+DEH5Iug4H9WJRB8X+uvupq/BdD1GxvkQIoStm84fZjwcDvBf:VOzB/iU0b3+YKu7dk7IF08E8rV494I/d
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
8515de2556f7142e53fe6820ecbf016b_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ