CancelDll
LoadDll
Behavioral task
behavioral1
Sample
0077c7977d0c7953a6538d636c599462_JaffaCakes118.dll
Resource
win7-20240708-en
Target
0077c7977d0c7953a6538d636c599462_JaffaCakes118
Size
61KB
MD5
0077c7977d0c7953a6538d636c599462
SHA1
b649dfd8fd70a9144208464c428464304f5a7427
SHA256
124df13571cea4a1db98720d0bd99bc5cc7ab9c2c36e4a53e5edce01fd798fe6
SHA512
f10ed94d3105ad453c679f0aa47d04e10998f20cb74b64a66050b1cf82f1c6464174ac572ad3bd73634dccd1cee8dc7e0d8e6438676b5977068ce256e26d8920
SSDEEP
1536:IVzBEv06rlo5xGWbI3Nstvre+B2HP5+lKgltP2r6AjIUEnd2:8Kv0olo5kWbu2pa0cPO/tPs6ATEnY
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
0077c7977d0c7953a6538d636c599462_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ