CancelDll
LoadDll
Behavioral task
behavioral1
Sample
f9e7bf11a45cee5dac739cb6155a4baa_JaffaCakes118.dll
Resource
win7-20240903-en
Target
f9e7bf11a45cee5dac739cb6155a4baa_JaffaCakes118
Size
63KB
MD5
f9e7bf11a45cee5dac739cb6155a4baa
SHA1
ce5da4907ae7a11ef5c835fb6ebb362916b44ea5
SHA256
0b67b2be778c0a537d66bc9700014ff14fef5bc83017afd38e6cb556410d5809
SHA512
8065eeaaf9b63932ba8ac4dc9666f0a5452dd02237c2fe97c5eecc25380182324b4dcd40688ef453669e85a04cf4dbc5f22ea203d2c965391ac3a8f4506b6c9b
SSDEEP
1536:IykzkagkZCXiftOMuLBryp8BI1x9P7qGRUvKkwnQWop4VUyAy:IFzka+XE0MuLY8BI1x9PONXwQWop4Ay
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
f9e7bf11a45cee5dac739cb6155a4baa_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ