CancelDll
LoadDll
Behavioral task
behavioral1
Sample
a3ffd099ad0895f8d3001037528dc2ab_JaffaCakes118.dll
Resource
win7-20240704-en
Target
a3ffd099ad0895f8d3001037528dc2ab_JaffaCakes118
Size
57KB
MD5
a3ffd099ad0895f8d3001037528dc2ab
SHA1
7172c55456d60ba6316fb58688034b95730b6422
SHA256
b8457f5a20070553b29fd805c8333bd318aeee2e7498e18bb38a523baae610ad
SHA512
1b5be5b3ab147e6df79fcc88e840a905cd6344eab7b0219ba45baffb7b845b42d320c5f27d99524cd77fdb479942dc91a25936abf0e0dde71f797f86bac3c6bd
SSDEEP
1536:Z6yEOWXF+dLH+RS8dzXxNKSKiG0Qq8CpauV4nW:Qc38RtdzrVGjrCpd3
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
a3ffd099ad0895f8d3001037528dc2ab_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ