CancelDll
LoadDll
Behavioral task
behavioral1
Sample
fddb5bc7bc754a802b8d13bf3129d3ac_JaffaCakes118.dll
Resource
win7-20240903-en
Target
fddb5bc7bc754a802b8d13bf3129d3ac_JaffaCakes118
Size
61KB
MD5
fddb5bc7bc754a802b8d13bf3129d3ac
SHA1
62603e8fd1010e5c20107a44519385d6006bbcd6
SHA256
de3c1ec4feae5b5d17a8c67fc11200ef46b91c705ec62578a49baf89e8c26611
SHA512
be0675d26084f6fab705084a65b31f44b3c964a521c4deb2a27ff30c7aa463e39a990f06ecd7a6b73dcd9f44210aad8d518592f0a89389f8ed8a2ab0d1c91b85
SSDEEP
1536:dQ76ypVpO9YOevCautyAFaOKDpWx4U2ljWgfhWpIxcHxcwDuBt8:S75VGYcxZwpI2VVWpOcRcwDCa
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
fddb5bc7bc754a802b8d13bf3129d3ac_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ