CancelDll
LoadDll
Behavioral task
behavioral1
Sample
de73de04f3d1d8538d592a253d11ccae_JaffaCakes118.dll
Resource
win7-20240903-en
Target
de73de04f3d1d8538d592a253d11ccae_JaffaCakes118
Size
76KB
MD5
de73de04f3d1d8538d592a253d11ccae
SHA1
b950ba635f4a5433d003f6a4820d63d3deb466f5
SHA256
16822aafc00eaeb54e277594f5b54544a20d55a06e609920d1b5133c9be8afd5
SHA512
0411e877ef499c62f688a74ea1a8f89d65682d27b6b8d7175534484b64bfc34abad532a77053707dbb97d353fd6f0d721fe4ecd60b2dd58af04386e3b0dfe8ef
SSDEEP
1536:IykzkagUR3ZHwEeNPDc3I/5Robr0zdZP0hmEibX0gcn0:IFzkaF4qK0APILibX09n0
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
de73de04f3d1d8538d592a253d11ccae_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ