CancelDll
LoadDll
Behavioral task
behavioral1
Sample
fb3cbc4d84847abb278025f7c29135a6_JaffaCakes118.dll
Resource
win7-20240903-en
Target
fb3cbc4d84847abb278025f7c29135a6_JaffaCakes118
Size
60KB
MD5
fb3cbc4d84847abb278025f7c29135a6
SHA1
8dcc7659aa7d139dedc173a10b803a04798ae73e
SHA256
33b179405aadf7358abb7a5f2992b4ae2270cf1f24e6574296b2aa4a34e8e5a5
SHA512
b1c4ffca9e8e8ddd749885b7e54a361b14b22927b424773b5144ccb7aaaa359dc053672966d6825f06b33af763c68d7a517af282a4157969f03bfc2296754196
SSDEEP
1536:erdK3M8POcNX65/4Wrxdp+dsWz+933TIdq5DlN/ka:EdKHNXrWdds+o+938c5ZN/ka
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
fb3cbc4d84847abb278025f7c29135a6_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ