CancelDll
LoadDll
Behavioral task
behavioral1
Sample
ad3dd53b23bff29b5f1a395012e559e4_JaffaCakes118.dll
Resource
win7-20240705-en
Target
ad3dd53b23bff29b5f1a395012e559e4_JaffaCakes118
Size
55KB
MD5
ad3dd53b23bff29b5f1a395012e559e4
SHA1
09bb97b1de1c8fadd0abe792b6e212a7d6b1a2f7
SHA256
6d7030828f4223ddf9b28865fbbbe2e0907b8d992312cb98087d9b0cb44c4ab5
SHA512
32bacc3d233482d3d46cda00d00c12c79596a13143bfb0a5cf3db3b95d85cade4e3d12ed08b9ac67e5b1b9d35ec37ded3c322136534ba34678cdd7ad19b1ee50
SSDEEP
1536:V7LV29Z+qXQdXMdub3V2Cda0B2+eQTYtHF1Kr6Xi:FU9Z+jkub34zl8YtmmXi
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
ad3dd53b23bff29b5f1a395012e559e4_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ