CancelDll
LoadDll
Behavioral task
behavioral1
Sample
8ec367916e89c4dfe4db625a3657c8c3_JaffaCakes118.dll
Resource
win7-20240704-en
Target
8ec367916e89c4dfe4db625a3657c8c3_JaffaCakes118
Size
68KB
MD5
8ec367916e89c4dfe4db625a3657c8c3
SHA1
ebbdde408559b15010c73d0a045faa068ee9f89c
SHA256
0b721520096ed286371a47de15c85106eba65b9844409e5a0f9e96a5e440a0a0
SHA512
32b4261882fa94ff0266950de72eb30fc42d51ad54cc8da6c5942849e34cb2e40ea85cdca3f3e07402895535f08444bfe36694d7020bb133f54b4425101db380
SSDEEP
1536:68C3PjhLOQkTz1+G8M2GXUTZ1oQ5n4igF9+k1YlWpuKxLD3L6s82h:68APjh64tM2dfJ4L991YkpnZL6sPh
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
8ec367916e89c4dfe4db625a3657c8c3_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ