CancelDll
LoadDll
Behavioral task
behavioral1
Sample
8c79b726ffdae27a262da628712cc604_JaffaCakes118.dll
Resource
win7-20240708-en
Target
8c79b726ffdae27a262da628712cc604_JaffaCakes118
Size
64KB
MD5
8c79b726ffdae27a262da628712cc604
SHA1
13778bb48fbafbd9d4cda2ad4d0759af35b53d7a
SHA256
8584203ae1956818b59e38f1f0ae6faea6eb75b6aa127375109b15c56112bf65
SHA512
18d67a97b7242d0b336ef866db0c1572cbe85718ef686555f1c5b9d108431a245a9723bc7708be3ed8d8acc5256a3246b9c6fba39a19016c343ebd67d1e5c4a4
SSDEEP
1536:LkywKamAFxvJDroLP1bN8VWTbRsp0J5P63We2:i9ZFxvJDroDP8VWSp0e3N2
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
8c79b726ffdae27a262da628712cc604_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ