CancelDll
LoadDll
Behavioral task
behavioral1
Sample
d38dc2fb2d9c916d42607002a58513cb_JaffaCakes118.dll
Resource
win7-20240708-en
Target
d38dc2fb2d9c916d42607002a58513cb_JaffaCakes118
Size
81KB
MD5
d38dc2fb2d9c916d42607002a58513cb
SHA1
63f38771e5b9244d7a0749a16e1959b99fafb777
SHA256
42e29ea03e333d25b306a827c6016facd4a19f6dfb6d512f2378c098285889f7
SHA512
9c9b803814e23300f0c68d6a77d31035433bdbdaaecc73e9665e7da09b1e39ff8fa67394605dad83c3e262688fb8ad0fae55105a0b43df18c0b8309b3852ed27
SSDEEP
1536:IykzkagpRZ1xbdtY6aWE6tT+/XYSJHy6zlRVNKFH1hxcaXDE/gPJBZ:IFzkaYZbbde/r68QYHy5/xpzE/cJBZ
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
d38dc2fb2d9c916d42607002a58513cb_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ