CancelDll
LoadDll
Behavioral task
behavioral1
Sample
00cdb9d83a67a363e5238cf380613920_JaffaCakes118.dll
Resource
win7-20240903-en
Target
00cdb9d83a67a363e5238cf380613920_JaffaCakes118
Size
57KB
MD5
00cdb9d83a67a363e5238cf380613920
SHA1
ced536648b2f21f30372d7bc8cc2fca5dd8be882
SHA256
61176e93963a51e4bb13680ab0604f0aa967065f10963dd1a2c7491c46350f6d
SHA512
bd19890220c748a86e90190d6d4ae918da61e9fa6fa63c59d14f1dea7859a0ed4fadb49848869286b84351677393a916a48beb35b577531d85603e9bae7942b5
SSDEEP
768:KHL7W1ZZQkHdYs3NP2WL0J6FXH7Xves/TA5piQAleH2wryB4inl1X9itcf8NOr9P:jS4eYRh2wXMFTryBR1X9Ucf8MErpKt
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
00cdb9d83a67a363e5238cf380613920_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ