CancelDll
LoadDll
Behavioral task
behavioral1
Sample
b490bb8c037860a4feb164cec8d719a9_JaffaCakes118.dll
Resource
win7-20240708-en
Target
b490bb8c037860a4feb164cec8d719a9_JaffaCakes118
Size
47KB
MD5
b490bb8c037860a4feb164cec8d719a9
SHA1
7f6ebea03a8379cba2a4e77744e8f131a4a7ff2f
SHA256
4a04314a7e74930590f239b53d693f5c8836e06c496c2a9bf2e1eb17493a83a4
SHA512
486cc7d26f58ea0c7a1224ea4bd2f285163b796936533573070d617bf0c1fa6bf7983d91054a3a872cf3429ba7b00b98c5e81994df8c403c69b331217e79c285
SSDEEP
768:FPUwXWaTfRELlWCyzfAgxCn6LsuCs2RDy0jKIB1gNUG84wKPjdJE5WZw/0U2bpq:hXGa7ReQCU7LsifJnX6aw/X2bpq
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
b490bb8c037860a4feb164cec8d719a9_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ