CancelDll
LoadDll
Behavioral task
behavioral1
Sample
fa4bcccb9b53aecdedc3058302b2dbe4_JaffaCakes118.dll
Resource
win7-20240903-en
Target
fa4bcccb9b53aecdedc3058302b2dbe4_JaffaCakes118
Size
70KB
MD5
fa4bcccb9b53aecdedc3058302b2dbe4
SHA1
827a7b7000f4d15fc9cdd97705047c155b6936b9
SHA256
b05daa326cc22f30480bec6ba9933059604680691cf9af59305c566a4ed3a1ad
SHA512
2c1ee9e7f98db978301bbf544eccd9769a8de7dc3601981f4342b6162c285138efdb2ffba6bdb3e5353a501c710bce91aa2459e592a86cb0e899f2431a0e7aab
SSDEEP
1536:IykzkagAO7kiUA9RJyutjPGVoDjHkE8TyuXLs4Toq5LQqgw:IFzkakAi/3JyuQVUf8rXdToUEqR
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
fa4bcccb9b53aecdedc3058302b2dbe4_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ