CancelDll
LoadDll
Behavioral task
behavioral1
Sample
2e1f0d5ecbba7e0c3f3f9c232e3a1e74_JaffaCakes118.dll
Resource
win7-20240903-en
Target
2e1f0d5ecbba7e0c3f3f9c232e3a1e74_JaffaCakes118
Size
70KB
MD5
2e1f0d5ecbba7e0c3f3f9c232e3a1e74
SHA1
28554c8affa08df125bd1be77f58d3b0c12c7fb4
SHA256
d7ee32b502111d8ec51fbb259757a389eacfcdde2157d6d615a98a2096305f10
SHA512
c2744b6c049df62ff8f42853ff6bf08b3855ff8e1d118f2c4e662f8148c8ec7e6656974466276300176c7b0f2bd7f996c42b11402d9a8f853f1c66cb1365aa78
SSDEEP
1536:LCnK+Gmtwj1Gj9TZ4HmmI0ncMDDfMkZjF3AJPuUniOzA:qExGBZ4HmmI0n3vMk3GXiUA
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
2e1f0d5ecbba7e0c3f3f9c232e3a1e74_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ