CancelDll
LoadDll
Behavioral task
behavioral1
Sample
89fc10fbd97a2fb9b9848650c3945ae6_JaffaCakes118.dll
Resource
win7-20240705-en
Target
89fc10fbd97a2fb9b9848650c3945ae6_JaffaCakes118
Size
67KB
MD5
89fc10fbd97a2fb9b9848650c3945ae6
SHA1
d6e0edd84418eea865b324f75b1636fd2746e078
SHA256
c00b702ad9c79c3606f36d48cf59e23074c54bcf7c590bb4020fb2454ba836f1
SHA512
d2d9be9a2b72a55d8147ae9a6dea46d512ceb04593973ddfde2cb55d6e3de27312782ef0fc8fb5ebb48e39f38854fe97fe0cd6868d7dc6ebc75822b79d800bf2
SSDEEP
1536:x7li0adAjHlD+6QnB+NAsNbKU2PL/RqNTgCT91IbHFHD:xBUajxKjT/RqN8CJ18HFj
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
89fc10fbd97a2fb9b9848650c3945ae6_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ