CancelDll
LoadDll
Behavioral task
behavioral1
Sample
ef944df27628c111e338060cea8a31ee_JaffaCakes118.dll
Resource
win7-20240903-en
Target
ef944df27628c111e338060cea8a31ee_JaffaCakes118
Size
56KB
MD5
ef944df27628c111e338060cea8a31ee
SHA1
ec59ee06070ffff0e97dc2b1c6fe441a1615878f
SHA256
2e0d84e47ca5dd397d29a3bd56f019af97c21cd747f334e2459081abd604f066
SHA512
5e5fad8f6c92c1eae496d25913def19137db32e7801fb4cb2ef13af8288e736601e9c6d5b46807d7a40075ddb1e7df767713dd9362426743aabe66dae3bafac8
SSDEEP
1536:Iykzkagtqx4Hm7fNQVVMpF1hXUvc/EErX:IFzkauRHm7fNPDXUABX
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
ef944df27628c111e338060cea8a31ee_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ