CancelDll
LoadDll
Behavioral task
behavioral1
Sample
046b8834559a3e9d95cdb8ecbda35fc4_JaffaCakes118.dll
Resource
win7-20240903-en
Target
046b8834559a3e9d95cdb8ecbda35fc4_JaffaCakes118
Size
48KB
MD5
046b8834559a3e9d95cdb8ecbda35fc4
SHA1
e02021c7f5b2046fc0367232de03d608092d346a
SHA256
b0a5d254572f005ea1e4369d3264d44cde56ff2c59a2666c1a6567b0f1cc4bc0
SHA512
52a104f1b6b9a0f262e770547c8f2c834381e1269094d1ce761f533822f30ae17459d56ea9c1c4db4a7b98fad3d1426c8753bca9f1d0df575a47624a92115da3
SSDEEP
768:mJEE5lPcN8FQHKLCrbJEhQeitRiXatm38fxkOTpFwgkSR9x1QyfKKDTIiF1:iclHKLCfJETitRzfxkOc6rx1PfKKb
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
046b8834559a3e9d95cdb8ecbda35fc4_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ