CancelDll
LoadDll
Behavioral task
behavioral1
Sample
85ad25fec8a4af075673e0c23a2cab23_JaffaCakes118.dll
Resource
win7-20240704-en
Target
85ad25fec8a4af075673e0c23a2cab23_JaffaCakes118
Size
67KB
MD5
85ad25fec8a4af075673e0c23a2cab23
SHA1
3e7725d94dc98f9983693121929142c7f02b4890
SHA256
bcf3e10b3b4c5789ed8958bb21b40ff6f68fb57a42935ea85eb7161a01faa6f2
SHA512
1f0b46a2a20aa75e61043ed32b34390682ec92368dc1d769c87e4d5c615ce449a57b2e11bb31ff57046e22adabfec76f1a9b82e4c8dc3a4e8fa96d46b5d57c49
SSDEEP
1536:OpwTqjU7vTTKVpo+DB94eDIUlkLUS78kRBAa3kHYnVNMnT:Osn8pb26zlkLUe8IBAa38YV2
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
85ad25fec8a4af075673e0c23a2cab23_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ