CancelDll
LoadDll
Behavioral task
behavioral1
Sample
d61441038f2de2236cd118ece41697dd_JaffaCakes118.dll
Resource
win7-20240903-en
Target
d61441038f2de2236cd118ece41697dd_JaffaCakes118
Size
68KB
MD5
d61441038f2de2236cd118ece41697dd
SHA1
79db99abe40e5d10f0631c4c834fc0a5b4ba5d04
SHA256
3977a3c8111e37cbc689835bc0112dcd9641407f3ee1c4adae5113b4937a5871
SHA512
c55204015d44edf4c11275a0f85fdd4d50810e50bc075a13b4b83f15d2d6df4d15d7c7adb68d1e7416feb338d58e48dd109cbf14f6312377be1360e641215704
SSDEEP
1536:9HF3cPoVMJvEZTlHmJjHPFDi76JlXY9iOx6gaCk0vQUMHq:/3cPoVKEZw5vFOzZxLK0sHq
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
d61441038f2de2236cd118ece41697dd_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ