CancelDll
LoadDll
Behavioral task
behavioral1
Sample
fbe5a4ce4f8fbded501506b785b0a861_JaffaCakes118.dll
Resource
win7-20240903-en
Target
fbe5a4ce4f8fbded501506b785b0a861_JaffaCakes118
Size
75KB
MD5
fbe5a4ce4f8fbded501506b785b0a861
SHA1
2cf9f00f13bf0f79be99c8b8602d82ae295468cc
SHA256
e804877e5894429fd3967d82d1141bf8f4df58f37d04553e03dbe8c6a9c77d56
SHA512
7c1ee4e0d9e03f9bd2947f1db7df652b2ff97e19fd93662585b72ef173d075f245a4b16f400da6c2e4e1c6ed2bf1a914fe51ac8e69a5c668ea204df182d774b2
SSDEEP
1536:LkywKU3JdACRPIrUMayW99hwbcFLNUKwMQx+MKhFNSNN3:iPdBPI1A99h7UK7QxGMNZ
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
fbe5a4ce4f8fbded501506b785b0a861_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ