CancelDll
LoadDll
Behavioral task
behavioral1
Sample
b3831917bb848a5d2ef82b36e98dbbb9_JaffaCakes118.dll
Resource
win7-20240708-en
Target
b3831917bb848a5d2ef82b36e98dbbb9_JaffaCakes118
Size
65KB
MD5
b3831917bb848a5d2ef82b36e98dbbb9
SHA1
4abcb1001c66f6aa63114550f8f369a2ef367918
SHA256
ae04265c0dd30ea0445d13cc93d6483573ead44c0db1819d7346112a97cc1331
SHA512
8b0db701e282f6cca0782e2bde7bd7115b53b28b13d7aa951979b2ba24ca04ab47c3ad65143aea035fd9d863f11902a217b8050f0c69f1d860ea19145e90c9ee
SSDEEP
1536:jPe9U37hoSsKFdT/htBcLv1FxEVw6Fz/nFcxA70:C9U37SSsqFcr13EyuvFcx5
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
b3831917bb848a5d2ef82b36e98dbbb9_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ