CancelDll
LoadDll
Behavioral task
behavioral1
Sample
ab4ade1fabb90ddce34bf8cdd50c6f79_JaffaCakes118.dll
Resource
win7-20240705-en
Target
ab4ade1fabb90ddce34bf8cdd50c6f79_JaffaCakes118
Size
35KB
MD5
ab4ade1fabb90ddce34bf8cdd50c6f79
SHA1
c717d46145de9f796e2eaa8105dbf3aae710fab7
SHA256
89e0606abdfb9fa239bf270122e0884c0baf5422aae882b1a41d613a6f77499a
SHA512
763fe6a3cd46104b16edbbd2b715787c20a294334bea54dce400bd9cbe562d7dd349d604ca32a9bf799d95d1ad051517c889764d685f783b4bfdc6719d44ceb3
SSDEEP
768:rBL0gOHcbDHZKuYlmtR4/adNEKSL7BHajzIjK0f6/kWQc0vvrw:Jd8cHHQRmjuazLU7hqEjw/mds
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
ab4ade1fabb90ddce34bf8cdd50c6f79_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ