CancelDll
LoadDll
Behavioral task
behavioral1
Sample
0d78a733ce8b1194be5515028c2e18a2_JaffaCakes118.dll
Resource
win7-20240903-en
Target
0d78a733ce8b1194be5515028c2e18a2_JaffaCakes118
Size
70KB
MD5
0d78a733ce8b1194be5515028c2e18a2
SHA1
f608b90ebae3b639eb1a317aefc02b3eb6b1893e
SHA256
87532831bfd6c7a2b0b4ce4b7217d28e62d3decfcae8107c4774df9e28b3208d
SHA512
1298e7aad6bebd24e02d0eb8b40e8406c1f3352b6cce2d3fd9bc34a4ce2d6441c5cd829ab5916a4bc310dfac71832f1fce9b889ecd0177510c04ad68a9ea12e3
SSDEEP
1536:dQ76ypVp9Fxev5ATsIrh6NqzFmC3Trb7hhkXLSVX3I1ogEyx5iDHbTDAav8IS:S75V/FxeGgmGqxmyBhgL4Iygfx5ifTRq
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
0d78a733ce8b1194be5515028c2e18a2_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ