CancelDll
LoadDll
Behavioral task
behavioral1
Sample
8a094360d0948b1ab7e6ee4fe1be096d_JaffaCakes118.dll
Resource
win7-20240708-en
Target
8a094360d0948b1ab7e6ee4fe1be096d_JaffaCakes118
Size
54KB
MD5
8a094360d0948b1ab7e6ee4fe1be096d
SHA1
5ff89ab63a5c02ffe15c57b09af605746eed33e2
SHA256
2d55d05c8f0c8a8c5ea56729b31030b471e07e21ae4801af341a0b73276b207a
SHA512
ca9f7473b8c6f2084e0884ed7c516f2552f966eab311b66fd4b306242ee30001992d7374aee102ff873f98f2eb5b042cdaab9e3b89fe2162440dde8d4656401f
SSDEEP
1536:DVV1HTA6WTEnsbOfAQaDUc5iy8/l4LfVi:DVrE6WYBIUc2duc
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
8a094360d0948b1ab7e6ee4fe1be096d_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ