CancelDll
LoadDll
Behavioral task
behavioral1
Sample
b3cf59dd3e87b79fcec79f3bfab2e914_JaffaCakes118.dll
Resource
win7-20240708-en
Target
b3cf59dd3e87b79fcec79f3bfab2e914_JaffaCakes118
Size
67KB
MD5
b3cf59dd3e87b79fcec79f3bfab2e914
SHA1
b1fdda7d84925efda82e124f044a4572b82c85fd
SHA256
59511330cdf330f810ffb395c49ce9e23ebdb9f7e7a99d49a56ff1e81dd45a5a
SHA512
7a42eb2d3efc770d5daee5935d1c3dd59b7876b9d8b75af8642b21707ad3db7d760027c98a0c6ecb0b67d39dbbd2b1f96760f6f717655e4353356f48fbebe66a
SSDEEP
1536:CjAO15+SxfpZ35fufgyzRu9Ezs+pBoDS/wYrSdbBZw4bdW3giEw:CjAO+S5pZqLu9XOJrM2SKd
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
b3cf59dd3e87b79fcec79f3bfab2e914_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ