CancelDll
LoadDll
Behavioral task
behavioral1
Sample
ac37fb997ad7d35b059f6844ccb5ca72_JaffaCakes118.dll
Resource
win7-20240705-en
Target
ac37fb997ad7d35b059f6844ccb5ca72_JaffaCakes118
Size
66KB
MD5
ac37fb997ad7d35b059f6844ccb5ca72
SHA1
f8aa6dd0e00d8e44beb836e4981f7667d5179d0e
SHA256
ba6b3bd15f1d7bd97a385481bd713f87165cf196912e3c8fa91471221aa512ad
SHA512
0c728f69065df2f3a7db78d088c3f34a3f367f698538689b5b261de86a928b80ea02adb3754313edac6b32215f9a69830006c60515250df154f93b126333cfe8
SSDEEP
1536:hXGa7ReQC0jIRrEZ6NyQKdbJrvHf1SbaDHdBh:r7RCeIRQRNL/1SbaDd
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
ac37fb997ad7d35b059f6844ccb5ca72_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ