CancelDll
LoadDll
Behavioral task
behavioral1
Sample
24dfd09e9675e2c4261236099f327cf1_JaffaCakes118.dll
Resource
win7-20240903-en
Target
24dfd09e9675e2c4261236099f327cf1_JaffaCakes118
Size
68KB
MD5
24dfd09e9675e2c4261236099f327cf1
SHA1
08d37bdcca1ed3d3e8f1f4e994b77ccea271b33b
SHA256
ab3383be7ec9d096fcd99c1570d987a4a340b757a2f883fd31ce345869dc3342
SHA512
23e281f2968fb05d9984152c0fe6ac533d1f06a7677c0bc9b34d7888bc411405bd47d5d2da508258d22a100c0a0675009a47a1950c2277025d8e7548e56efec5
SSDEEP
1536:yjJMzqRhEZLaWIQNL+wAAAGzUeoYmIJz25fsQ/3y5Y+TpQyAbz/M:ObEJaWIQNanAAGzTAv0BTpobrM
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
24dfd09e9675e2c4261236099f327cf1_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ