RegisterDll
UnregisterDll
Behavioral task
behavioral1
Sample
d2b9394f43c28812355ac463c77b43c7_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d2b9394f43c28812355ac463c77b43c7_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
d2b9394f43c28812355ac463c77b43c7_JaffaCakes118
Size
48KB
MD5
d2b9394f43c28812355ac463c77b43c7
SHA1
ac749c496f3549c6e6fc2d5b646866e49d65272d
SHA256
b86eafd32017879aa71912a6425d63e989c1ee66550df92c545e31f07d2bc5d3
SHA512
0f6f65d62297073a2e3d88b410bc787c1aa4cab21d50ed422865f5a72ccce27475100511e233088d9357a78d3cca1d8b8bb48ba8716d3ba4dfcc78c0251f1173
SSDEEP
768:o21IKPM1EHIhi2jxrjYdE+YOMrwzIOkDzfLtYb5kxXEzdQhMoaQQZOxQIpnC2ng:p1IKECHuimrAE+WrpOkXhbxEpAM5hZqs
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
d2b9394f43c28812355ac463c77b43c7_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
RegisterDll
UnregisterDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ