CancelDll
LoadDll
Behavioral task
behavioral1
Sample
180c521766869132df5edc41f5938eb7_JaffaCakes118.dll
Resource
win7-20240903-en
Target
180c521766869132df5edc41f5938eb7_JaffaCakes118
Size
54KB
MD5
180c521766869132df5edc41f5938eb7
SHA1
f7c347d56ddc4109f35027cebdb21fd96202b49a
SHA256
2e416f8dc25f3e48e79c0147facba983ac1e442a1cc1ac1dcf057b39898debe9
SHA512
7aef08e00635173609ef9ff1a158e02f7c88bb7eff8fa20d400eacc39d3321bf28b1f576b24a7b40135769f9e7232276837823459043a449f0d18e51130cf9b3
SSDEEP
768:eBgNHK3ObAv/0MNjjh4F5Fc+qKLjJ/BYb3idsVg3Dgmx2QQ1jnKnIkJTzycRLcVX:v9kvc4uLkKAssVg3DgQ5Q1jn4PDiVbr
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
180c521766869132df5edc41f5938eb7_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ