CancelDll
LoadDll
Behavioral task
behavioral1
Sample
0c625a9b768e0737623eb3ba9fb8c552_JaffaCakes118.dll
Resource
win7-20240729-en
Target
0c625a9b768e0737623eb3ba9fb8c552_JaffaCakes118
Size
67KB
MD5
0c625a9b768e0737623eb3ba9fb8c552
SHA1
a9bd83d970e4344294e8d37e148dc4f56c652a41
SHA256
766acd2b8b58311c517cb9496e0c559e14b89e8a095d0ad0de85d8358cac2b81
SHA512
737ecf446e30b07c0206bbf243fd29153428467674e83710ce85c3641f5a00bdfefe5a526444d91e3cea977b920c809bca396b6f4c94393ab12c62642ccd549f
SSDEEP
1536:YIQGK22iAKrHfg5YJSCX+QBIkXIVQhiexmDekhyn7wRg79nFz9na4:Z1AuxJSQzZXyQ0exmDPKzX
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
0c625a9b768e0737623eb3ba9fb8c552_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ