CancelDll
LoadDll
Behavioral task
behavioral1
Sample
951022494356a36c5d63414b9fb2785b_JaffaCakes118.dll
Resource
win7-20240708-en
Target
951022494356a36c5d63414b9fb2785b_JaffaCakes118
Size
58KB
MD5
951022494356a36c5d63414b9fb2785b
SHA1
975f9edc89ef17187522f019415289248128e857
SHA256
7013f1f55b32c69c4e4f480700d77adeb6c375076fd0721d4834b721652952ad
SHA512
6aa44adb040db3fe5c60f1cc53b86d3fd6b24a3f3fe5b26e82273c9a93114bc6ca2296f8fdace5f8d17e51957c3e09d307dacbc27658eec0225de6d8488f927b
SSDEEP
1536:E7ZJUiHDhkz6WRYyY2F+4r5jEuYwAKCl5gv09y:EZdCzn1tF+qpEuYwVmy
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
951022494356a36c5d63414b9fb2785b_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ