CancelDll
LoadDll
Behavioral task
behavioral1
Sample
ab093c33e2827e1ec29e58ac6f33d52f_JaffaCakes118.dll
Resource
win7-20240729-en
Target
ab093c33e2827e1ec29e58ac6f33d52f_JaffaCakes118
Size
61KB
MD5
ab093c33e2827e1ec29e58ac6f33d52f
SHA1
7cb790ea4ebd98020c3adde36e5e6d1da03655f5
SHA256
79f0771e6bd54549d18efd6eecd7c7350ab5c9cf6635695232c6960afadb1708
SHA512
df3bf43033953b78af7fc6d4864dd5c3f62697bcacdd31ff656ff4e41aec2037641958db568c04fe258625ea0016d1254caa058b048946a6d1ed24db77ac1b6a
SSDEEP
1536:R75j77DqwMUekfyx5fBYCRKbwiZ+tqVCpEs1RRh:R75jXDqwMURMfLRKsiZ+wVIEuHh
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
ab093c33e2827e1ec29e58ac6f33d52f_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ