CancelDll
LoadDll
Behavioral task
behavioral1
Sample
b34e2c81d48a18b4c8b369b8c9347948_JaffaCakes118.dll
Resource
win7-20240729-en
Target
b34e2c81d48a18b4c8b369b8c9347948_JaffaCakes118
Size
47KB
MD5
b34e2c81d48a18b4c8b369b8c9347948
SHA1
de111efcc79b9179ba6fad3129c52a49ec2d4677
SHA256
ce3308f1c74fbd76bbfa6843aa147fd23a12a5249d2f532b2046c2133e52f6c4
SHA512
81b17ce74128e902c15ce36b1d4647dceada335f13a72fdc9cd34d0e1f35c39cdbc135870f0944c59b76bdffae6c346751a05001760bd7f81e1631e0f70f2c9e
SSDEEP
768:uCOzB/iH5ip5NIJNYuiTj+voNKdlyamRiuAMvBcmlxtn7jjFztn7y:VOzB/iUpONfiTKKaBciurJb7Py
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
b34e2c81d48a18b4c8b369b8c9347948_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ