CancelDll
LoadDll
Behavioral task
behavioral1
Sample
39ea111a998c66dacc89886b8761188f_JaffaCakes118.dll
Resource
win7-20240729-en
Target
39ea111a998c66dacc89886b8761188f_JaffaCakes118
Size
71KB
MD5
39ea111a998c66dacc89886b8761188f
SHA1
4c88d299e17cbd8023e3778db0180615302871f9
SHA256
c5c92febac34b1e3712e37cc17160a3caf3ed62ea2de5d7be3c6009a22f9fe70
SHA512
5bf14519297f39a82ca6be990a372aa12ce95468278c9c4dd77c57dc69991c11f2f98054cf103e0728486e9f5f52ae530eef03bdb99743195468d031531cb11a
SSDEEP
1536:IykzkagU99HyWim2uOVR56jte9dt6LMClUprwlq:IFzkaHdvOfOt6dtMNiP
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
39ea111a998c66dacc89886b8761188f_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ