CancelDll
LoadDll
Behavioral task
behavioral1
Sample
b50321645d84c39232bcf41137600153_JaffaCakes118.dll
Resource
win7-20240704-en
Target
b50321645d84c39232bcf41137600153_JaffaCakes118
Size
48KB
MD5
b50321645d84c39232bcf41137600153
SHA1
7f29a8a77cd7986057f3d6dc48bf7e88202d366c
SHA256
18c6f64c30e63307cf7b5749d1d3da9732fbb8aab3b10ebf3eea14e76f5464e5
SHA512
e416a56a1b618ba0fb52d357f9e63dfbb71747abbdf273de3242fe8a03841262c01fc3ff4009f33f6e19dbd5c2fbb3414e46b9fc94d1d30a1f714776b85850e0
SSDEEP
1536:dQ76ypVpFtyHAWOzWKrIZbBGKhRXc55veqZn:S75VftfzSbBDhRXc5heqR
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
b50321645d84c39232bcf41137600153_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ