CancelDll
LoadDll
Behavioral task
behavioral1
Sample
f68bc458172a45a92e9f581905a77552_JaffaCakes118.dll
Resource
win7-20240729-en
Target
f68bc458172a45a92e9f581905a77552_JaffaCakes118
Size
75KB
MD5
f68bc458172a45a92e9f581905a77552
SHA1
d3253b5ab8e08f6c61379b56be19d3f21673616c
SHA256
629110c5153ff4d65893bc8ae8d2fabc310ac702fa015240238f15fdfcea8417
SHA512
de2288ff997aabf2f12cd8cd158f11f3931b76a6fb91ed966abc39e0009af5d7945db2cd2d7d37f126b380a4003f480e3531d1075d232835f4757658568f2cad
SSDEEP
1536:hXGa7ReQCadXhLG6/EB48NrOJcYK9/7rFJgu0DNskrT5bgRowD:r7RCeX5uG8Ndjysgdk
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
f68bc458172a45a92e9f581905a77552_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ