CancelDll
LoadDll
Behavioral task
behavioral1
Sample
0344f7f1bcd0d1479dde3ed922d71100_JaffaCakes118.dll
Resource
win7-20240903-en
Target
0344f7f1bcd0d1479dde3ed922d71100_JaffaCakes118
Size
58KB
MD5
0344f7f1bcd0d1479dde3ed922d71100
SHA1
ea44030858441215ed8a30ab0ba1d5ba930be2be
SHA256
9fe5e0db9acf7179f2731e02d5e47e035e930225d5e200206d58c5970f5747d1
SHA512
00fdb4b0bc59ccc4ebbc64f536bc62a0200ad47280aebad320fd423419ac92e56cd2c6c1c4974baa4027dc9c63b4407012ef97a4877b18590e4b8d3307b46dae
SSDEEP
1536:O/S0kb1ndgGUtPQlI1DY3gYIs5t7TVwZ7AVtwxj:O/S0kbZOGyr5YwYvfVwC2
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
0344f7f1bcd0d1479dde3ed922d71100_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ