CancelDll
LoadDll
Behavioral task
behavioral1
Sample
28061d4ba87c3fd5aac388905a65285c_JaffaCakes118.dll
Resource
win7-20240903-en
Target
28061d4ba87c3fd5aac388905a65285c_JaffaCakes118
Size
59KB
MD5
28061d4ba87c3fd5aac388905a65285c
SHA1
50633ded53efea68a7d90a8cfcdd5c4e259ab1ee
SHA256
b00b1dc1e751edec24e19c09df3c24e033f6c9a171d891a2ea599961e90581aa
SHA512
c79b0d15a3e4c087df81a238dd2ab554646510510f7148eec4131a7c8f083d576e717d317e0dfdf62565c8624877ffc66aafd69687a50d53a7bd4cb090427deb
SSDEEP
1536:V7LV29Z+qXZ/tq2u2oOE8tGeBlne8NkmGzXg:FU9Z+UED2REEXB8Q6zXg
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
28061d4ba87c3fd5aac388905a65285c_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ