CancelDll
LoadDll
Behavioral task
behavioral1
Sample
dc410696cf8e52cd98f9ad8874a044e8_JaffaCakes118.dll
Resource
win7-20240903-en
Target
dc410696cf8e52cd98f9ad8874a044e8_JaffaCakes118
Size
76KB
MD5
dc410696cf8e52cd98f9ad8874a044e8
SHA1
3b6d9b24e37fe3f76f37d9711eb5ca59a4786d89
SHA256
4d2b65db9aa5ff63d29bd0157b3efe0d22a7f8e08732c0870817b2c26f29b8f0
SHA512
bc7fd17e33e4cbf8230acb6578a14d8467cd1612f9a3c0ec45e0351a1bf465e7778c3c8aff1009355db1cd508d76308177e1a7988c948fe27d2404989f08228b
SSDEEP
1536:5yoC1RPk6nPRTF1rO5hLx8PNhb0qiv6hKSUI+3pvo22aT:kowM6n5THShLxWT0QhKSc9ocT
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
dc410696cf8e52cd98f9ad8874a044e8_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ