CancelDll
LoadDll
Behavioral task
behavioral1
Sample
27cbe9b410c19408a51dd6767500479d_JaffaCakes118.dll
Resource
win7-20240903-en
Target
27cbe9b410c19408a51dd6767500479d_JaffaCakes118
Size
61KB
MD5
27cbe9b410c19408a51dd6767500479d
SHA1
0bc56ab434e67940670a89fa5bd2a12665deb8f1
SHA256
ed185aebf100039fe9b960ae63f1f21e2baf2ca75124937bc58833e13702ed37
SHA512
cc6fba8d8d8277d3de194296707513409e71caa42c6b32ee57a21ca41b9974ad4581715b6b8ec52f2dd5232347e38fea14a9b64bc11cce3743c678e81d17e5b9
SSDEEP
768:gYP8Ffy46RtuJswM3Jj8icI2L+xShCKc0MYHc0qt22g5YAZX8QIn46FXE4P9DCNF:AJzFYxp9LHq5X2tdGORlDO
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
27cbe9b410c19408a51dd6767500479d_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ