CancelDll
LoadDll
Behavioral task
behavioral1
Sample
1169b5a2b78e4cd33243f28d51662bcd_JaffaCakes118.dll
Resource
win7-20240708-en
Target
1169b5a2b78e4cd33243f28d51662bcd_JaffaCakes118
Size
14KB
MD5
1169b5a2b78e4cd33243f28d51662bcd
SHA1
705a111c3a65c3d96aec3f4e846deee0b46d6b88
SHA256
fdfbfc7ad30334af5b24d43e53235857658d92a8cc2dcb0762eb834fdfd68031
SHA512
46827b14a04c4ab926bb19ed3d0d3b4cc9321bd65dd0a71d2928e72bb6482d6f45027af688e5abc963823f1b8caf6d7d153582e1f4d5057d7934636af8e6993b
SSDEEP
384:LKBE07cxc/6FrBrBFmL02wcWDRtCuhA7JlnmwF:euYcxhPTmnOa7JNj
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
1169b5a2b78e4cd33243f28d51662bcd_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ