CancelDll
LoadDll
Behavioral task
behavioral1
Sample
bde657a51deba9599ea77d1c0975e99d_JaffaCakes118.dll
Resource
win7-20240704-en
Target
bde657a51deba9599ea77d1c0975e99d_JaffaCakes118
Size
75KB
MD5
bde657a51deba9599ea77d1c0975e99d
SHA1
a1087a27c6f7f1e5252b257ec53ab7d2a0b46c18
SHA256
add76b15b78c85101a43f4b92b286eae8fc1ba236e5047f6eb5a8e064c5c7ed9
SHA512
1bf7be8c1c7061b9e4024d4aed2a7bc0c213668f8028cabe1b3946bd25e3f4fa5e2b68618ba7f9493e89f4e43ae5fd321be191ecf9ec62ec29c57e67ef7ccd8e
SSDEEP
1536:IykzkaghpXndw/o7mipQnQMWRH1WULwJ89N3oiTAciZtsYTqEy:IFzkaeXnd/Bh11NkJ89FowQtqEy
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
bde657a51deba9599ea77d1c0975e99d_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ