CancelDll
LoadDll
Behavioral task
behavioral1
Sample
a1647756e5dbbd27bc5a7290f1b67302_JaffaCakes118.dll
Resource
win7-20240708-en
Target
a1647756e5dbbd27bc5a7290f1b67302_JaffaCakes118
Size
68KB
MD5
a1647756e5dbbd27bc5a7290f1b67302
SHA1
f41bf4bc120aae0af4a8be4f44ab92d12d53a3c3
SHA256
228fc60bdfe5660216b4133b35388dd24d2601d40670ab0c8a4dd0ab84d1dfe6
SHA512
baec9795fdbcefaf5e36cd5142d9d237f8bf109788791dc97b2e203d9081ff33faba7cbee1ecb940255666a139154e02b056ec523c86679a2f585b121a35a462
SSDEEP
1536:UMNxZuGt9YD6QcyQ2I75IDbzKBSaIpAQsQn75eLnLvDAZ:UMNxZuGt9YDJp3I75ebzESaIpAQsQn7T
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
a1647756e5dbbd27bc5a7290f1b67302_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ