CancelDll
LoadDll
Behavioral task
behavioral1
Sample
bdf830e2c1847e75cfa1a1dd866f7670_JaffaCakes118.dll
Resource
win7-20240704-en
Target
bdf830e2c1847e75cfa1a1dd866f7670_JaffaCakes118
Size
59KB
MD5
bdf830e2c1847e75cfa1a1dd866f7670
SHA1
586e2b2c0e56320f34b8ca6a022af729cde38431
SHA256
fb0c21b9d213d15d0a3c01b0876b18aa663d657579bb184ca839d5c49ce56e2f
SHA512
5136e9f5b59715cafc87f47cdab3ff274a77cd524355e004d1ac27dbdbc9da26a80461ca79ea2086e7d1a76c0dd432a8dfb2a1ce1b4c558b7ce44ba5da80edb0
SSDEEP
1536:Iykzkagv5NVN3Q0vpu65crOyL0o8iPK1qn:IFzka2NVySpu8EL0FA+i
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
bdf830e2c1847e75cfa1a1dd866f7670_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ