CancelDll
LoadDll
Behavioral task
behavioral1
Sample
8ded518195dd06f56b9b4670b387c8c4_JaffaCakes118.dll
Resource
win7-20240704-en
Target
8ded518195dd06f56b9b4670b387c8c4_JaffaCakes118
Size
63KB
MD5
8ded518195dd06f56b9b4670b387c8c4
SHA1
a9e0b369fc15b56c7b5e27179d5a9f723f872ef1
SHA256
4c2c2c2a48c32792f526f1234e7daabfc6df5b194daf7ae2c32866da9625850a
SHA512
c5049139b7a36fbcb8a41a84a8e94c6b638695ec2b9c4eb7496bab0c282c08e2bb8afad9a21a93cc3e1f170e24f5300d5a92f62d63ad8e261df0a9c1ab37b6c3
SSDEEP
1536:hXGa7ReQCc+zFGcuf0FfdE/DWoDf230NC+ivzwFJZlQ4M:r7RCcsFRuf0xeDWYf23jvzwFtZM
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
8ded518195dd06f56b9b4670b387c8c4_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ