CancelDll
LoadDll
Behavioral task
behavioral1
Sample
06bcb9d95ec01fd06eac26d3ab167a15_JaffaCakes118.dll
Resource
win7-20240903-en
Target
06bcb9d95ec01fd06eac26d3ab167a15_JaffaCakes118
Size
69KB
MD5
06bcb9d95ec01fd06eac26d3ab167a15
SHA1
7e5d660f5440c0bd2e53683a4cce3e11a3f5278f
SHA256
9dd4b64e431a57f2fa5916112aca0537c95eb886032f036b92a02fc5bc62d73f
SHA512
161dec1c6d26724109a257ca692dc66748a7e867e61dd839259d870465a15fc07ffe886934aae306fea055b92c101664e7c3a83d144e5d20808408f6bf5ba944
SSDEEP
1536:jS4eYZK1U+ORUxfCsVW82tXgQuIQSuWjzG7NLWs73IqlrCXo0RU5:+RJ1O0HcsIF7zYJ73Iq1CXI
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
06bcb9d95ec01fd06eac26d3ab167a15_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ