CancelDll
LoadDll
Behavioral task
behavioral1
Sample
ba1836d1069d9d37935f2931ccb711d0_JaffaCakes118.dll
Resource
win7-20240704-en
Target
ba1836d1069d9d37935f2931ccb711d0_JaffaCakes118
Size
63KB
MD5
ba1836d1069d9d37935f2931ccb711d0
SHA1
47cd45246e7245568f3e1780930779d127c2eacb
SHA256
3ed2cb5876c9a1c34442dc8cfea1d32b2840d257b73af074405367ec31885d76
SHA512
750986b356d7454392ccdf708a6a44bc33c9f3b45602f6972e1bf1887a26cfc8372812a9f8ec8241baee82a2cbac5425510d103ebea215fb9b5b89ed4dc901cb
SSDEEP
1536:EdNs9O6qwtr2EFpIr2TWw6eKeaDLsxb4FvSTPOJ:EdNs9O6rrucT68aDLs4FqTPOJ
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
ba1836d1069d9d37935f2931ccb711d0_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ