CancelDll
LoadDll
Behavioral task
behavioral1
Sample
d5026207d1a65b4593cd0fe9a80c8e22_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d5026207d1a65b4593cd0fe9a80c8e22_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
d5026207d1a65b4593cd0fe9a80c8e22_JaffaCakes118
Size
55KB
MD5
d5026207d1a65b4593cd0fe9a80c8e22
SHA1
25c9cbc0e3a4be3f3dbb4988bef766436f2a26ce
SHA256
38d9f4c668092dcd9a324bd0970f9822bfb7e9b495a10daa61ef4fb26937fd6d
SHA512
eaa33cb849422b944523b1afffca5da9f640413a4e0fa6120cb72fadf0dd9fb4e0f47159a662e555142cf5aec45aea86044386547db5fecdc098a452661f7638
SSDEEP
1536:5X54meaMxtF3wj6/32nQg1Pweef1LpEIjvsejjpTy7:5X5/MHuw2Qg1oewRpDvsejjU7
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
d5026207d1a65b4593cd0fe9a80c8e22_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ