CancelDll
LoadDll
Behavioral task
behavioral1
Sample
da7fd10e90820970270418e8a3a6503f_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
da7fd10e90820970270418e8a3a6503f_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
da7fd10e90820970270418e8a3a6503f_JaffaCakes118
Size
58KB
MD5
da7fd10e90820970270418e8a3a6503f
SHA1
078ab809eaa91e2dfdfad57dcabbe985161a53ee
SHA256
e80a66c24f483d39efaefb0a769934c24d295c009fd5629113c237c777c0b793
SHA512
5a402ca9314e4ca353dacf002f0803303a5c28b8a7e392337785ca04c7c3d8afb0f272e72558725dde1d126760ee2a2fde2212553cc35eeb3940343595e729e6
SSDEEP
1536:LCnK+Gmtwj1GMLjheVEBWDjrC4LYQ20cXexDtOg:qExGMLwEBw5SexDtF
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
da7fd10e90820970270418e8a3a6503f_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ