CancelDll
LoadDll
Behavioral task
behavioral1
Sample
befa5430ee6898c4a172d811ccb79d9c_JaffaCakes118.dll
Resource
win7-20240708-en
Target
befa5430ee6898c4a172d811ccb79d9c_JaffaCakes118
Size
65KB
MD5
befa5430ee6898c4a172d811ccb79d9c
SHA1
10d38c0fc840d25a51b442634a1dce411234adb4
SHA256
46058122446f9bf47b6395fc61104bf00da26912f2ea5ac9b2cecf1fe0bb1f69
SHA512
3b742be504a3e122b6eafc52e0c4df5833378e1783309b33ee5f1ae958eddbc0d03f9ce704a2de4d0260fe5b3c02cbe6d3a86f0d6c805758d8f8b62d174e0743
SSDEEP
1536:IykzkagatHNTc4ZuNk9AwpKVdSnIhNXe76:IFzkaBttTcGuW7MNX7
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
befa5430ee6898c4a172d811ccb79d9c_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ