CancelDll
LoadDll
Behavioral task
behavioral1
Sample
de1b55906c7a1305b1a88698a7c5d9f4_JaffaCakes118.dll
Resource
win7-20240903-en
Target
de1b55906c7a1305b1a88698a7c5d9f4_JaffaCakes118
Size
76KB
MD5
de1b55906c7a1305b1a88698a7c5d9f4
SHA1
6bf053adaa2b8d211040e776f8bea3976ee42846
SHA256
9398bcb867f7fa58f1320135db99e10370972ad2754761efaae643b14f59fcb9
SHA512
d714bb23ebe8099e5d5373e4a937b0d4a62998792f48fc64d4b20e057f0f8d5a7058f69c47ac8f90c7c85ef287d0b201b56eaed369b6ded56470ee98dba4d663
SSDEEP
1536:Iykzkag74dciIeJqU8Y5kX60tAAO3fj6RawYRKWiXKAK/onuRLwd8dDMiES:IFzkaVgSd8TwAOPj6RGRJkEAuRLwdOYS
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
de1b55906c7a1305b1a88698a7c5d9f4_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ