CancelDll
LoadDll
Behavioral task
behavioral1
Sample
034607f43ae6d7e32ad45b4808a47310_JaffaCakes118.dll
Resource
win7-20240708-en
Target
034607f43ae6d7e32ad45b4808a47310_JaffaCakes118
Size
68KB
MD5
034607f43ae6d7e32ad45b4808a47310
SHA1
b5e8a7fdd6209298d16a5e543aca9673151fe4d6
SHA256
7bdcdc3731829f8490b967f43eda7b5e55beca9997154aaf138b605d4b692054
SHA512
cf259b9c8ca7998ab1f1ca1c816fa366e6d63053920d72d738d81d44795748a95c6b6302c5c58a40cdf0d350d3ecb35895a1425c04b9f83d8a9692814c17a4cf
SSDEEP
1536:3QKSrV1fi48q4PmJlE4hiLfsSrWHcsDEzjbfmEhqlohwu7zkV:gKsrfUqLJO04kSrW8QQ3fmPlohwiIV
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
034607f43ae6d7e32ad45b4808a47310_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ