CancelDll
LoadDll
Behavioral task
behavioral1
Sample
0022bc5e2294718143dd452d18c534dc_JaffaCakes118.dll
Resource
win7-20240903-en
Target
0022bc5e2294718143dd452d18c534dc_JaffaCakes118
Size
54KB
MD5
0022bc5e2294718143dd452d18c534dc
SHA1
46405ef9c5bd8ee75becfd9edac9e803bcc133bf
SHA256
a50bd159a0dad938563dcd1bf35dca72f35880b37de1165bc67720adfca524d2
SHA512
d3a4b5d01829167e88fba4b0c64dae844fb819260a54835f3c1b3b8eb920dea80fc35d5608ee270844fa1b40602873c50013deb49a4433d4e417c4b39c42f590
SSDEEP
1536:uyIdnstoOrJ1+VqhrZNR9sVfYwsyJ5R9rbK3j:bIFstprJYi7HsawsyrR9fK3j
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
0022bc5e2294718143dd452d18c534dc_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ