CancelDll
LoadDll
Behavioral task
behavioral1
Sample
be0c3313c8f33b346812eb6bebed0b62_JaffaCakes118.dll
Resource
win7-20240704-en
Target
be0c3313c8f33b346812eb6bebed0b62_JaffaCakes118
Size
58KB
MD5
be0c3313c8f33b346812eb6bebed0b62
SHA1
f1f005d03a9ed1ad3fe9d235cd6210723b9c3a19
SHA256
362b819322743a2495cbbb7b83740d26e9528cd68c9a682722edfc9fce2a5e49
SHA512
c68396e043eb6d816c8a236fcebfbc2c412aeb673ca5ba186d7bb80f443ffdf065f3e4210e6700803b889e98506c1c946f7329c86a4cb8fb94fa375b83531630
SSDEEP
1536:EdNs9O6qwtr2z9NruaAj0VYAscgRWtUM411DOaT3+/vfT:EdNs9O6rrsrcKOdf9HK/vfT
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
be0c3313c8f33b346812eb6bebed0b62_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ