CancelDll
LoadDll
Behavioral task
behavioral1
Sample
003f40905f9816ada7c0c839603f0452_JaffaCakes118.dll
Resource
win7-20240903-en
Target
003f40905f9816ada7c0c839603f0452_JaffaCakes118
Size
63KB
MD5
003f40905f9816ada7c0c839603f0452
SHA1
04664815c809a9cb5cf9fc3a16b8f538befd3484
SHA256
43975c8d4c1360c79453fc6cf99aef0145c1d5d5fbe0da8621ff774861919007
SHA512
46f428ddd93a4bb0256612942dd793599d992f9cda7f78cf14391e72cf67617238ad26978fd1c5bfb720cff0d8f41b6e38a6df6bd233a1cce6d4b028c094c39e
SSDEEP
1536:4pSt9HJRcss5oEeNA2JW4XvnofEEVt4YjDvcDG:jJKss5neNBj/UEEiG
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
003f40905f9816ada7c0c839603f0452_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ