CancelDll
LoadDll
Behavioral task
behavioral1
Sample
e0ba444a0a98259a2f3d7504ec53b6ac_JaffaCakes118.dll
Resource
win7-20240729-en
Target
e0ba444a0a98259a2f3d7504ec53b6ac_JaffaCakes118
Size
55KB
MD5
e0ba444a0a98259a2f3d7504ec53b6ac
SHA1
0d983b3a80a6eca04a0e23dce5fb316c580deb02
SHA256
b5c418656892ad3ce257e17188f81b019b70f7a56bb2323c1e01a93c2b43c14e
SHA512
3804073e289b145aee8c9c47586cd84a29e6c840b1700ac50734301bedb7bc02fe5bfb2db5a789632fbd64b49134a5ddc399949ffef9735936110f9fea75cfb8
SSDEEP
1536:s+j6Ir7zxtF3wj6/32nQg1Pweef1LpEIjvsejjpTy7:sk6szHuw2Qg1oewRpDvsejjU7
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
e0ba444a0a98259a2f3d7504ec53b6ac_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ