CancelDll
LoadDll
Behavioral task
behavioral1
Sample
b3cddb1794f231384a8c3130b92cee5e_JaffaCakes118.dll
Resource
win7-20240708-en
Target
b3cddb1794f231384a8c3130b92cee5e_JaffaCakes118
Size
60KB
MD5
b3cddb1794f231384a8c3130b92cee5e
SHA1
c3e910591e1c6ec673b631590d76ca51214ed4e9
SHA256
971fffb443d20e93abbdd51d8ac2665f64504773b59914fe8a45ee07f712ef1e
SHA512
23f0a32bf882d3983f6453d01f4848166390b4e5f621623d0fe8bc5754173e2d59294337127f578ad9fad5a5a967ce68730356f22c604d9f96743814df7cc019
SSDEEP
1536:VOzB/iU9GJ7Ex7Td2z1UoltQII8M8S2G4PrOit:VK/ibJ7UdeUoltk8wW
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
b3cddb1794f231384a8c3130b92cee5e_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ