CancelDll
LoadDll
Behavioral task
behavioral1
Sample
b5afcce12772c0d7e863c0b843c83bac_JaffaCakes118.dll
Resource
win7-20240705-en
Target
b5afcce12772c0d7e863c0b843c83bac_JaffaCakes118
Size
54KB
MD5
b5afcce12772c0d7e863c0b843c83bac
SHA1
2a4c9fb42cc69ebf54c8bd1ecb84eaf3ad4ec538
SHA256
683409cfd11a20c292b9189ea575e2c0dfddee0055655da5044b01ba5f30d6ee
SHA512
181b7fe94ab778f23eb8fed6dd456ece4a6dc9c1db42f2be82c243937c74230f5ecb9cf1a7dc96954aff2c9b9758cb9707334604b8140ef63e061d8696f32b5c
SSDEEP
768:R73xlB/LOtoi6OgwrxA2SusgIH21I8behD+EzLgG59Hd00zayd+eHutw6QLkjpFt:R75AvrxAhus8C8bmzLbddzaeHuteLyl3
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
b5afcce12772c0d7e863c0b843c83bac_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ