CancelDll
LoadDll
Behavioral task
behavioral1
Sample
889a6402dbf81f389f4110998bce0639_JaffaCakes118.dll
Resource
win7-20240708-en
Target
889a6402dbf81f389f4110998bce0639_JaffaCakes118
Size
60KB
MD5
889a6402dbf81f389f4110998bce0639
SHA1
e29bda2a34b8e5b228d8d4a8b1e005f701d2dcca
SHA256
b236eefc6b2f5b89988753db53a55b9f98eb7da6be71ebbe0b801bb61a7d630f
SHA512
ccb8ffa26e9749b8ed5fcc75ef0ef750288acc26824fe0c48fb0fc646c9e478e6a44bf3328c79133f7f38d1f2945b7d5b1f83fdaa54fd8d4c1b56665726f15ce
SSDEEP
768:eBgNHK3ObAv/0MNjjh4F/3fy27gxCL0WURHNY6UIfHw+s6RWQ1c53RaGCAF9hRqd:v9kvc4u86LIdNY6Ch3gyLosQl/6i/Frr
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
889a6402dbf81f389f4110998bce0639_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ