CancelDll
LoadDll
Behavioral task
behavioral1
Sample
10193dd3e93b299996365c2d055a8f23_JaffaCakes118.dll
Resource
win7-20240903-en
Target
10193dd3e93b299996365c2d055a8f23_JaffaCakes118
Size
54KB
MD5
10193dd3e93b299996365c2d055a8f23
SHA1
64f148755ac5757f46b4b0be7dc904b931b8e9bc
SHA256
6daf7ef8460ed63afa42f098d326577c5eff5f2d63ec75928a3e84a7879d5127
SHA512
5049da72b592579ab9c86e735a83e791ff8bb1fa0e7d221bd35c5916c950b6e44f48d7cb80b7bb82ae5d7c190ab4827d3ee61df31ac3146288b8c387169d5dcf
SSDEEP
1536:hXGa7ReQC9qHZOQVvzgKCJgxVF2gNOIhEkJ2YUqZKVA:r7RC9qHgO8KDXsdqUS
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
10193dd3e93b299996365c2d055a8f23_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ