CancelDll
LoadDll
Behavioral task
behavioral1
Sample
a5a43e08e91927ac3635f87dbca78f0f_JaffaCakes118.dll
Resource
win7-20240708-en
Target
a5a43e08e91927ac3635f87dbca78f0f_JaffaCakes118
Size
69KB
MD5
a5a43e08e91927ac3635f87dbca78f0f
SHA1
75ce861c60d7771e9497ab1305fe080eb434c767
SHA256
5db02dd9ff6329b0142a8b29e0591d2bc2fd3235b3f380999b33370298721770
SHA512
e7b938792fd937289a0cf92f1cc944b7a4e86950e1229e93a17dfa6051f3c0ed8ef6da482ca42c42ca717e668734b34b924f0cd2adbe6db346509542d156235f
SSDEEP
1536:hXGa7ReQC3cwyuRABlxiP5mFs7EQ4MXSNg8G11K2TvJ:r7RC3cwTRMo0mj1Th
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
a5a43e08e91927ac3635f87dbca78f0f_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ