CancelDll
LoadDll
Behavioral task
behavioral1
Sample
304a5150088e6e1ee2257d9cc54e56a3_JaffaCakes118.dll
Resource
win7-20240903-en
Target
304a5150088e6e1ee2257d9cc54e56a3_JaffaCakes118
Size
66KB
MD5
304a5150088e6e1ee2257d9cc54e56a3
SHA1
5bfb058d50f20ac431d6359b322699070bb6034f
SHA256
c88a4a057b1be01dbe39aad6d7da44a7bc4862d15da17130ff77110ad1f05d7a
SHA512
62ec7fb61d9fe6a538176bb18fa11220cc614b7bf3155af51eeb277ecc36a2940eb8339fb64edfae113d97fb5df5360e9b078a38f1a948d0a022c45f9ca57ff9
SSDEEP
1536:75ZXMityec40D7xaJpLrIPSoN2LxcoQiH8KYpVWXusqzl4D:9ZLncr2pXHTLxyiH3aVKupzl4D
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
304a5150088e6e1ee2257d9cc54e56a3_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ