CancelDll
LoadDll
Behavioral task
behavioral1
Sample
b1a6811c7a81ea9058766ab07f82ffe0_JaffaCakes118.dll
Resource
win7-20240704-en
Target
b1a6811c7a81ea9058766ab07f82ffe0_JaffaCakes118
Size
47KB
MD5
b1a6811c7a81ea9058766ab07f82ffe0
SHA1
a8b22d70fb430b6b1aad5f54916eddd4f5a073a4
SHA256
28de264544eb27eb0f5e8df9d2b14c078fcd54d536b748e99dbb7e59c8394cd8
SHA512
36e9652700fbca6214274adb56630956cc70c7f08a49bfb47e1ffb90b2b4aafe2c4a94dfacce2ea097541eae213f75cf9580308ed286eb75d3410b90b4b9aec0
SSDEEP
768:7nl7ZX0LityRecQ5XZH+DLWAw2Ua5Ww1iKZJNO3jwqegdY1USS4qmca:75ZXMityecC52U/K3Ncwyp70
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
b1a6811c7a81ea9058766ab07f82ffe0_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ