CancelDll
LoadDll
Behavioral task
behavioral1
Sample
c94c31c8b14b06da18e59549db13aea0_JaffaCakes118.dll
Resource
win7-20240708-en
Target
c94c31c8b14b06da18e59549db13aea0_JaffaCakes118
Size
66KB
MD5
c94c31c8b14b06da18e59549db13aea0
SHA1
8017bf03dd9537b508963b0e4c8822f8505680c8
SHA256
e4162723f0032ea3008abc88e24f414911d6ee50aa6c748b506fc2d9845b6c10
SHA512
ac278ae98e1ea015ea3fd31ff6c41eb250a5f7906a176e51051f08ac022505158ffdf8b288e6af9836e5768191bff0a159c01e53f8f549da30cb24da01486fce
SSDEEP
1536:QkywKqzL/YaAXzVTuLaw07fAuuJyMfnOJh/:Z7fzAXzVTuLy5uJyM/OJh/
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
c94c31c8b14b06da18e59549db13aea0_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ