load
update_load
Behavioral task
behavioral1
Sample
d6be5999adfb09ce778836a18d8e3f70_JaffaCakes118.dll
Resource
win7-20240903-en
Target
d6be5999adfb09ce778836a18d8e3f70_JaffaCakes118
Size
89KB
MD5
d6be5999adfb09ce778836a18d8e3f70
SHA1
3ad457717376f4926caad58bee1f903ae7fdce41
SHA256
feb1acbe9d46ed8e80763eefafd840827d68d9ad02554f28fa747a768e43807d
SHA512
c64f7af2b31b78e6c20189e70c208188ea5a9b6458116d0aa819fbfca3e471c050e4aa39f94ca07a442eaf5f0a50615ab81abd195b0a3e2d5e3bc66f22cda518
SSDEEP
1536:X0bHCdCC4F1cU++0O4+Vg/GwFY4Cp64AXRnnKVWmqIXMYBPaO7:X0bHECC4FeP+0O4qdwz86PnBZYBPaQ
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
d6be5999adfb09ce778836a18d8e3f70_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
load
update_load
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ