CancelDll
LoadDll
Behavioral task
behavioral1
Sample
c10bf6d9c638663a8b2bdd44121db044_JaffaCakes118.dll
Resource
win7-20240704-en
Target
c10bf6d9c638663a8b2bdd44121db044_JaffaCakes118
Size
73KB
MD5
c10bf6d9c638663a8b2bdd44121db044
SHA1
af577b75982b78604c4c8cc2dd67b2b51ccf14ba
SHA256
770a4d4f934c1d9352c721fe1c9cb3427468652cbd7cff9c1368b9996f4ac444
SHA512
264d249f23780207b7b0cbe678cce263ebd071efe20f1230f3692c80480080609aaef2aa06d2716bf4d11aabd2623df39b6140d5d34c6f88ce6aa2c9c4363097
SSDEEP
1536:Z6yEOWXF+7jAGvT/qOgKGCZ118kU80SeYhEMmlXz39r9FZA1Q:Qc370EdYCbSkP5KZpz3hT+q
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
c10bf6d9c638663a8b2bdd44121db044_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ