CancelDll
LoadDll
Behavioral task
behavioral1
Sample
e21b4d290e8c1b68fc8093f2b52d504f_JaffaCakes118.dll
Resource
win7-20240903-en
Target
e21b4d290e8c1b68fc8093f2b52d504f_JaffaCakes118
Size
51KB
MD5
e21b4d290e8c1b68fc8093f2b52d504f
SHA1
a997706871f9083fc2898182ae0c18ed8a231e0f
SHA256
86aba578fa1111a66c5789a1cae3621cc077253a8cefeb7c494071659047849e
SHA512
c14ded1060273e3deada74abbde70fc2a31b4995e4d1c4d3ed0589a0c671779359a85882109e98b9519e5a6b18f5076a34108916ae2c4a5311ff5a47a3991b87
SSDEEP
768:n1PaoMAC9K3kLiqDUfm13CHaZdc/B+qOTyKm2SIAVoTLiSTJE6mINxFe:n1P3M7Gqoeo6Zy/B+KpXVoTLiyJ7m0ne
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
e21b4d290e8c1b68fc8093f2b52d504f_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ