CancelDll
LoadDll
Behavioral task
behavioral1
Sample
05dcece67f82feef8a885eeff1773ff2_JaffaCakes118.dll
Resource
win7-20240903-en
Target
05dcece67f82feef8a885eeff1773ff2_JaffaCakes118
Size
63KB
MD5
05dcece67f82feef8a885eeff1773ff2
SHA1
9635332df874cda932cbbe3f52c76a941d375fbf
SHA256
12cd3c386132b897eb9ca37c34a164f576f9240f21c5585934403d3a6b5051e7
SHA512
56fa2e40017c14b6bbfd88eccb9a2b48a705a98f1bbe69b33d0b85b744d21c1ce9be3fad1d305a6cc0b31f85129f10a1882e832f1b277e557efb1d7633144c6a
SSDEEP
1536:itwpUH7lFbrM/2kC7tzBB4A3rNIBHUXSPTfuZz3JTfWJE:i3H7lFbrMetzBqGRIJbMBfp
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
05dcece67f82feef8a885eeff1773ff2_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ