CancelDll
LoadDll
Behavioral task
behavioral1
Sample
eb18446e1075416a444fe379bf3870f4_JaffaCakes118.dll
Resource
win7-20240903-en
Target
eb18446e1075416a444fe379bf3870f4_JaffaCakes118
Size
49KB
MD5
eb18446e1075416a444fe379bf3870f4
SHA1
d81602934dd10c8acb0fd749e495fcf5471ae9ee
SHA256
eafef77f22155df836d3d97b78164dcc629d8a8e206df6dcd9a1491a56229cf2
SHA512
f94f606eeec0294aa6b8934bd7dcbb37909e88b8a29b3f3add266adc4ba71e1f16cb673d287b20e800ba814cdccb746d8d565297e4aad0f23db4de4086108055
SSDEEP
768:IykIwePd8g7dHRuI8xKGQOxPltbRW7dvRZoWt603hbR8pO/rmoRQ7L+xGt:Iykzkag6ZUOZl6FkqFRt88c+Gt
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
eb18446e1075416a444fe379bf3870f4_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ