CancelDll
LoadDll
Behavioral task
behavioral1
Sample
2b22c1b1fae1b465ab565bb6296cde46_JaffaCakes118.dll
Resource
win7-20240903-en
Target
2b22c1b1fae1b465ab565bb6296cde46_JaffaCakes118
Size
53KB
MD5
2b22c1b1fae1b465ab565bb6296cde46
SHA1
17fef2c4be0a0549bf14a8ef10bbd76870b40b44
SHA256
f32b822101970081879066d136896905e3986ba46bba4ae098cdf7ec23fce9c5
SHA512
c8a96e9b64060765f94d77c54de66a2ab3e06a6e8157e596ab88631727fd55c956511470080c3db04e18ce7046f894ae9a7bbcd007138402ff3d6b0e381dc85a
SSDEEP
1536:Y5V54qWfzp/X60+HfVZ1aQbutMO3vCD5D/COfiW:2AXzt6BZ1aQUCD5D/BfiW
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
2b22c1b1fae1b465ab565bb6296cde46_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ