CancelDll
LoadDll
Behavioral task
behavioral1
Sample
b9ad3f8bfd863f85af1fbdeff9d98c5b_JaffaCakes118.dll
Resource
win7-20240704-en
Target
b9ad3f8bfd863f85af1fbdeff9d98c5b_JaffaCakes118
Size
72KB
MD5
b9ad3f8bfd863f85af1fbdeff9d98c5b
SHA1
5ade8c563ac9f17d8ee1d68bb969b7a1a62e8d52
SHA256
75e81611a2588e289b83fc6c1403da12aae7f85469ec61975ac3bf320884d699
SHA512
8345d2abfb3dc2a230db5e5a5d288b93d16af64e9af7da1895c34b076c128693c5295e24fa89f73d7e58bf7d04aa50af06e4342860b3ecb5f311cf1cc9324a40
SSDEEP
1536:jPejhxQzZde7Si1EIU+WS+9CNNjlLbyD4hhwoEt:CVCzeP1X+9CNhtbyDw4
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
b9ad3f8bfd863f85af1fbdeff9d98c5b_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ