CancelDll
LoadDll
Behavioral task
behavioral1
Sample
11994acb1fd86abb76d4a64fc083aa8e_JaffaCakes118.dll
Resource
win7-20240903-en
Target
11994acb1fd86abb76d4a64fc083aa8e_JaffaCakes118
Size
71KB
MD5
11994acb1fd86abb76d4a64fc083aa8e
SHA1
7213099181956ed54b641ea1fe1604e44a710401
SHA256
1e272eace9c5b9a5d16fa4e715e85a1d222e26466edee276b3897ebfb59d17e7
SHA512
da653e0b5525a687fc3fe0ad5fd1954feafa869a27712640ad78a36ec5ebfa324f6f296122c65076e1f5b4cef73732fe95e47c80156a39c989392c3e5faac34e
SSDEEP
1536:DkYOATOMt5nfDo9jPwf2+RJm2pbLhmsnEjLm6QOJ7KY:XOATOMt5nfDuTwfrhrniC6F
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
11994acb1fd86abb76d4a64fc083aa8e_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ