CancelDll
LoadDll
Behavioral task
behavioral1
Sample
d09e9aaa5b83235df9db9e85d4849c95_JaffaCakes118.dll
Resource
win7-20240903-en
Target
d09e9aaa5b83235df9db9e85d4849c95_JaffaCakes118
Size
46KB
MD5
d09e9aaa5b83235df9db9e85d4849c95
SHA1
20842405d01c5743e4827b4a9bc3441101849082
SHA256
c6cd2c47c8275b17ac28359af324ed239ffc778ef419d9f5472bda852c307605
SHA512
2d99c2ed32c6ff3148479e64090b5d8365642a72ccd328c41e132eb0a1c88a63734186e02f08945e0366829dbe21b9795c0e6320b779e4c4ee26f1d9ad14592b
SSDEEP
768:DVV27Pk2b+S9zwj3gVFAW628cbUqXx7hLNAqn/D5Q5/abg79:DVV1HToAW18cIqhl5AqnbS/T
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
d09e9aaa5b83235df9db9e85d4849c95_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ