CancelDll
LoadDll
Behavioral task
behavioral1
Sample
ba7565c433830aca4958dfedd0ccb222_JaffaCakes118.dll
Resource
win7-20240708-en
Target
ba7565c433830aca4958dfedd0ccb222_JaffaCakes118
Size
65KB
MD5
ba7565c433830aca4958dfedd0ccb222
SHA1
34f99df26d467e3d1e7a0797ef46b9b67c532825
SHA256
78c6994ebba7862e5d237cc6853b9cd683cacd7506f3e4df6d660408897c52cf
SHA512
d716a1c8383599c1b7c3a09a79e5cb37f38d34c4c488811e3c6c7d62c840770692855f30dfdd6bed5165f768bc24ef359ed802b1cb6d3842f0cc65160ae07f5b
SSDEEP
1536:IykzkagfYhZPCoccSX3nKL/9L66NfWGN/wJAFJ7a:IFzkaOYbPGcfr91fWCIa+
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
ba7565c433830aca4958dfedd0ccb222_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ