CancelDll
LoadDll
Behavioral task
behavioral1
Sample
969dac38c7d9036ae79fb5a8584f53da_JaffaCakes118.dll
Resource
win7-20240708-en
Target
969dac38c7d9036ae79fb5a8584f53da_JaffaCakes118
Size
57KB
MD5
969dac38c7d9036ae79fb5a8584f53da
SHA1
761ea00186c3918f4dba9610e4ac53d07a710429
SHA256
533c83095277f9adb3089ce72bf34c94f0189e7818f708aa5bd8345e85cf6039
SHA512
b2c0bac1247a5be30340437b4a046fcc9c1bac4087535f68226691628a3b551ce746e0d3a5dc757be130dd5738a998c53d23060d811d53dcb666bbe6173924d8
SSDEEP
1536:DWJMe+4fE3fruv8odPnkSHHIOJw32sFGOj5t:EMOfIruv8oVHoOJ+X5t
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
969dac38c7d9036ae79fb5a8584f53da_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ