CancelDll
LoadDll
Behavioral task
behavioral1
Sample
9421f3d4f8eee457a4c90855d87a4db9_JaffaCakes118.dll
Resource
win7-20240708-en
Target
9421f3d4f8eee457a4c90855d87a4db9_JaffaCakes118
Size
55KB
MD5
9421f3d4f8eee457a4c90855d87a4db9
SHA1
2e98d201b714adcc2ee32d0c54da93402e50672c
SHA256
213f86e84d48cf30b186041d6c6c69a17463ba19952581f2df2706753bf148c1
SHA512
6351b4c3ca960bffbb644f2fd83640d744b5913a67bb9ef840d6f2d56305f541568485f5cb4bdd4ef01c37c6e9f3c0abd6337487eda020fd16608fcb2b18d5c9
SSDEEP
1536:iYAUGL3CASgpG2hbP6V57qUUIb880m+HS4Q:PAp3zVc2F6X7Km07BQ
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
9421f3d4f8eee457a4c90855d87a4db9_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ