CancelDll
LoadDll
Behavioral task
behavioral1
Sample
b1eb09fc59ffdb016e4301c19b725690_JaffaCakes118.dll
Resource
win7-20240704-en
Target
b1eb09fc59ffdb016e4301c19b725690_JaffaCakes118
Size
61KB
MD5
b1eb09fc59ffdb016e4301c19b725690
SHA1
3dad2bf981bb70cb33098fdf65f802fc9c37a99f
SHA256
e864cc17bab3132b3c806ce8421a28a602e4ed8dd4138782160682a7f05f4319
SHA512
6a6030d0a0575c8e5377f30dde506e366c7c078f4acfb7c1ac6e9ebf23d213d537657b3f3488d3445c7f4d3185482bb3eb68c11026f8bc1776d948b0aea5a272
SSDEEP
1536:wAceoINVALIGpMB2kHJvYV2RhaR3pgECS2vZAD:wAcTqGE8kHJgV2QaEVD
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
b1eb09fc59ffdb016e4301c19b725690_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ