CancelDll
LoadDll
Behavioral task
behavioral1
Sample
0458089a6e4a6899111df6ce4e76e05c_JaffaCakes118.dll
Resource
win7-20240903-en
Target
0458089a6e4a6899111df6ce4e76e05c_JaffaCakes118
Size
35KB
MD5
0458089a6e4a6899111df6ce4e76e05c
SHA1
c231c5c3436f30c9e34702efb4f4d35b370821d2
SHA256
ac40e8a3913314fdc02ca0dee54cd8200f40c9eba4bd291852a1993047f3835b
SHA512
b6d8b3977204609ca15016c67ecca09b0db7bae0fe26b466c322f5fc54b9cd36a1b9ae324e660a438866e7dd71279031198bd9f9cc6fa7f1e7cc1ffcd314a55f
SSDEEP
768:KHL7W1ZZQkHdYs3FetttbNHldcBT4Bw3RfTy/57d0jDYZI8ib56YhO:jS4eYFitthFdcxIYfTM5Z0jDYi8ib56T
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
0458089a6e4a6899111df6ce4e76e05c_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ