CancelDll
LoadDll
Behavioral task
behavioral1
Sample
a289e590b5d07c22f9aa24a467fe3cd6_JaffaCakes118.dll
Resource
win7-20240704-en
Target
a289e590b5d07c22f9aa24a467fe3cd6_JaffaCakes118
Size
67KB
MD5
a289e590b5d07c22f9aa24a467fe3cd6
SHA1
4f1c2e9e9e5383a719d3b6c12d230c351d4b290f
SHA256
eb12d7d5dbdf4f6b1ee7c1eb33e2faba21e53ab29f9f127f91be131d26ea8570
SHA512
7af8a65f483cdc0dfe291ab5953ff318c965afe52ee186a3187ef22e7f730541fb1b2b8bf0f09beaba94d701c89b83b5dcac61e3ef2db9fd3043e5496214a6b7
SSDEEP
1536:UMNxZuGt9YD6QcQYYWBDFtvkoHmkpo28wUJfHWx3W:UMNxZuGt9YDJTYYWBDFtvk6mkulpJvW4
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
a289e590b5d07c22f9aa24a467fe3cd6_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ