CancelDll
LoadDll
Behavioral task
behavioral1
Sample
04eb6f4c758090022352610a46593341_JaffaCakes118.dll
Resource
win7-20240903-en
Target
04eb6f4c758090022352610a46593341_JaffaCakes118
Size
63KB
MD5
04eb6f4c758090022352610a46593341
SHA1
0678ecd77f999e2d1057aaee3880c04071cf3ec4
SHA256
b2d349bb422f0b48cbdcdab4075d0abe58ceb3d47050604e322e92a2548d05de
SHA512
7b3ac9a7ddd3b63c119f82a7c6efe66f3447ca94290738b362f670648363c7ac2e26df784a9b03bcdff06190fcd79098b5c1c40486f7694dc80e20f877856a67
SSDEEP
1536:75ZXMityec5T/BDo8t9qtTMY1k2KA0TEw79MtATHG561mzNzjaD:9ZLnc5TpD97KTR1k2KAi9Stcm0aN/aD
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
04eb6f4c758090022352610a46593341_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ