CancelDll
LoadDll
Behavioral task
behavioral1
Sample
d10f864fc581692bfceb54c936a61191_JaffaCakes118.dll
Resource
win7-20240708-en
Target
d10f864fc581692bfceb54c936a61191_JaffaCakes118
Size
76KB
MD5
d10f864fc581692bfceb54c936a61191
SHA1
988b225660a9a6b2c0f3f96e6ab0420bb9b78790
SHA256
f63bd577c870f2c1417931de7533c7f5f5f6528d39467464fd711e59c9c26fc2
SHA512
224e844c487d6e475519fd914aa19c06fc8ad4f01a160a7212c7f000be37d4fa1e4b7314d691b6cd64a2f53167409c3eb82884e76a4f95131382ca477db36072
SSDEEP
1536:4nxEzEgU+s6XWFC3RXL+/o9wjLdGhcRrE5/Izu+wOw:46pThb+g9wjI0i/ISXv
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
d10f864fc581692bfceb54c936a61191_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ