CancelDll
LoadDll
Behavioral task
behavioral1
Sample
a003421ec672a8cd7417a058673a366d_JaffaCakes118.dll
Resource
win7-20240704-en
Target
a003421ec672a8cd7417a058673a366d_JaffaCakes118
Size
60KB
MD5
a003421ec672a8cd7417a058673a366d
SHA1
ac12e678d8fe5cb121494a5da22b405b444def20
SHA256
565043ba836cfe4837ed4b16ab1909ebf7bc17ea2a1bb046474f3c3c9e3a2300
SHA512
83f60d8b98183c5a0af38106f2ddaeed5bc48278c6e352ea0450cc746cbb96a388f7f70760c86d14062de3eca328dc8a485e6bbd5163e38e4d7d3760641f1189
SSDEEP
1536:hXGa7ReQCmppfn4JXCjBez2lq8S2YuRA4bD4tLGYT0:r7RC0n4JXCjB1x1zRA/hZY
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
a003421ec672a8cd7417a058673a366d_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ