CancelDll
LoadDll
Behavioral task
behavioral1
Sample
0b9fa34d97d0dad12a567f7d5c9f714d_JaffaCakes118.dll
Resource
win7-20240729-en
Target
0b9fa34d97d0dad12a567f7d5c9f714d_JaffaCakes118
Size
67KB
MD5
0b9fa34d97d0dad12a567f7d5c9f714d
SHA1
00721d5f9e8623074a09c3cd922db39fdc37b58f
SHA256
e75773b37f1192af4f044c830b72b1253c5740615a83ca0b502001bde57031df
SHA512
f8d31ac7bfc89a8e5641d984203d7f152435a647a4992e6a9f3a692214a9c7b5029778dff6cd840fa808fbe42dd39a2b4d77cb8a261353a1e7e2751d326af3f0
SSDEEP
1536:DkYOATOMt5nxQlMsALa8sa6bgU6RLE7VygJ17L9URZ1SDJohcwt:XOATOMt5neMT+cRL2pL9o1SDaf
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
0b9fa34d97d0dad12a567f7d5c9f714d_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ