CancelDll
LoadDll
Behavioral task
behavioral1
Sample
d4df339fc87140e3065e9985cba63f6c_JaffaCakes118.dll
Resource
win7-20240903-en
Target
d4df339fc87140e3065e9985cba63f6c_JaffaCakes118
Size
65KB
MD5
d4df339fc87140e3065e9985cba63f6c
SHA1
394e04a9811d04ce3df9b1b478a6440eb3fa5779
SHA256
c0a214a96e2a4306e363c62c02de9753e2904fb4e4405c1f6f3d4a5073af9f8b
SHA512
2a6152806f53ef963d1cad91e32257c8ebef208c1d24feced3bc8878319890bd688c926cc5fca77871bf7c4807f6919d9342377b69783a2da6c72767a6c5cde4
SSDEEP
1536:K5VoMhdwDpiULyrz/tf01kBaS9KfuZB5A753OG2:QVoDwjbtAkBaSauDi4
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
d4df339fc87140e3065e9985cba63f6c_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ