CancelDll
LoadDll
Behavioral task
behavioral1
Sample
b2765cfbad45302f2756677a90038926_JaffaCakes118.dll
Resource
win7-20240704-en
Target
b2765cfbad45302f2756677a90038926_JaffaCakes118
Size
58KB
MD5
b2765cfbad45302f2756677a90038926
SHA1
a8d0b3dbcdaf7dce204f4ab08afb787e63165db0
SHA256
e9e1987a2ecfe2fa12b0c5b91e791f0ac6e26dc0c5fd8ecd5add0ae32e874e3e
SHA512
befc3a7d9df75b3d45fe0e645264482c218b67f3bf2c664c8fb78443aa914c60792b0e2656b3edf58f34e1975ebeb75f59955dbf623b25cc7311aceb76eab7c3
SSDEEP
1536:Z6yEOWXF+BY+oUU24kP6jJjb3zh3M9asI:Qc3BuUUTzVjrJ64
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
b2765cfbad45302f2756677a90038926_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ