CancelDll
LoadDll
Behavioral task
behavioral1
Sample
872008f7342e4d6828ddce53e4401a0a_JaffaCakes118.dll
Resource
win7-20240705-en
Target
872008f7342e4d6828ddce53e4401a0a_JaffaCakes118
Size
66KB
MD5
872008f7342e4d6828ddce53e4401a0a
SHA1
c4986c6e1ab88a68d8a0452b09725baab86d08db
SHA256
67c808579b1ec4a0da4010109a76b6496bbf8dcb1be18a72e0a0528358c74b7e
SHA512
96370a4318e560a41f2b11ba5c7f4a896c8ccfe293c9c887c1dab062dcdb5d3f186ec4b2a15f39f9196401338659b7ca67ec584720d0672f9f16bbeae41d8211
SSDEEP
1536:IykzkaggXAZxDlw/fKAKQvD410VpiN8YxYz047c/Q:IFzkaT42HPvc0VwakYz1Y/Q
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
872008f7342e4d6828ddce53e4401a0a_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ