CancelDll
LoadDll
Behavioral task
behavioral1
Sample
2bf76b811887038c6b31350c52a73592_JaffaCakes118.dll
Resource
win7-20240903-en
Target
2bf76b811887038c6b31350c52a73592_JaffaCakes118
Size
73KB
MD5
2bf76b811887038c6b31350c52a73592
SHA1
6c9d3b3d06d8ff66789d474ea4a99fb9c0d2abd9
SHA256
aa6a38a4e0268542160d3440bd1489f02c48604d662962501e32568d3ea5e7f8
SHA512
18f3c3b87a9dce116d4c8ff2d35f1c6995a3b4bcfb6bcceea9c31fba503cad18e473122bc35203e5d08a656400a7d88ee551ee705ea71f0855d99a93c76c0fdc
SSDEEP
1536:jPeVar9aVDUGYYsj8JftoigakC4KwcdZkgRFF/2U9tkVpGwt3Jn5:CVY9aV2Y28JfBga8Tc7h6UXkVpj5
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
2bf76b811887038c6b31350c52a73592_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ