LoadMapperDLL
UnloadMapperDLL
Behavioral task
behavioral1
Sample
311a74204962de59a6c072cedd2da5f5_JaffaCakes118.dll
Resource
win7-20241010-en
Target
311a74204962de59a6c072cedd2da5f5_JaffaCakes118
Size
24KB
MD5
311a74204962de59a6c072cedd2da5f5
SHA1
2d35dcb867c1efc9bb72e5ce221b2a1a37238cb7
SHA256
72bb25521d2a9fb501f304d7350e0aba3170b71682d2a080a12c3d28a8623ee3
SHA512
1e50ba33e82a9178587edf10ef27446a85eeb3a15b7e48a461eb755d246067a81baacbcf8dc58bacf9baf79a13e39dd0f6a59df242000d716d782b3c45b42271
SSDEEP
384:rhf4mS6q+hm2m0NHlGLZaMFHXGQnNOSNsjqSf+Rn1AR7Rmifz+0LTLCp+tkV:rhAm/hm1aQZaMFXGQnNOGs2Sf+RaR7R7
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
311a74204962de59a6c072cedd2da5f5_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LoadMapperDLL
UnloadMapperDLL
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ