CancelDll
LoadDll
Behavioral task
behavioral1
Sample
fd4aa675bb8a348fe23d6587df6f9723_JaffaCakes118.dll
Resource
win7-20240903-en
Target
fd4aa675bb8a348fe23d6587df6f9723_JaffaCakes118
Size
65KB
MD5
fd4aa675bb8a348fe23d6587df6f9723
SHA1
1fb3f516be711ee6c55da49f85a8bfb9d1e0dfeb
SHA256
2b6bbf1377f2e205716b89703c4b66b6d0374d4a739597ef0ee6812d81b61f7d
SHA512
5bfabee1c0bab3df942975fbee4d88cae70d63a1d99861d0ddde62d0ab9096b07e704179edcab72062fad747b11c0b6b9237ad6e2a4cd7184a3592a24c4cb5ca
SSDEEP
1536:jPeIZtyygstSHwVNZMoaFoB6TK2HU8BBb4gSmGkY2:CctTPtSHw5Moas8BBkg4i
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
fd4aa675bb8a348fe23d6587df6f9723_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ