CancelDll
LoadDll
Behavioral task
behavioral1
Sample
9492feec877d9cfc90c7bbc99f3486d4_JaffaCakes118.dll
Resource
win7-20240708-en
Target
9492feec877d9cfc90c7bbc99f3486d4_JaffaCakes118
Size
66KB
MD5
9492feec877d9cfc90c7bbc99f3486d4
SHA1
b75b6bbd1719170e2fa50b13a9536e53df85c011
SHA256
407c8b224a4fe9fdca9d564e773ed132acea27131ff1577eee8d75231280158f
SHA512
f8f169395cc175fa5b3dd9ec9bffd840680a690c81160423dbed101baa06baa2267b1aeb6f7a60de41bf3c7c01b3ee5d616d7eb3afd81f62f8ff99110befbc5c
SSDEEP
1536:IykzkagWp6PVXjWG+d8BEQ5bT98UdQUe1t7blJjBslRATXPq0b:IFzkaAP+d8T5bTdWjBs4r
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
9492feec877d9cfc90c7bbc99f3486d4_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ