CancelDll
LoadDll
Behavioral task
behavioral1
Sample
d3c5ec545f982492c1f047d5cd4010dd_JaffaCakes118.dll
Resource
win7-20240903-en
Target
d3c5ec545f982492c1f047d5cd4010dd_JaffaCakes118
Size
75KB
MD5
d3c5ec545f982492c1f047d5cd4010dd
SHA1
bd9806e2e09de2efd5e3459000a9e410089b0e65
SHA256
b6c9bf1a89d8f6f9941a3fb6974896c0d61ec47bab47c054de1fa61753de8791
SHA512
c305629f8d448738b72c85894cbc258264a5772dca0c1863a51d29fec6d7a6912ee1f4c148ebfe147e2016b2f7fdb11d994b3c9428442a81b10fa6d1196fdd9a
SSDEEP
1536:hXGa7ReQCSzC0AVlDm8++l3Vt5Da0DvZu5zQ5csB+dOeDaO51f4V:r7RCsCrVlTdbfMEas28Of4V
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
d3c5ec545f982492c1f047d5cd4010dd_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ