CancelDll
LoadDll
Behavioral task
behavioral1
Sample
39c8b25cecfc249e7f392614586f1687_JaffaCakes118.dll
Resource
win7-20240708-en
Target
39c8b25cecfc249e7f392614586f1687_JaffaCakes118
Size
69KB
MD5
39c8b25cecfc249e7f392614586f1687
SHA1
e913564105644d8e69fc69ecd59d34f4e23cc8c8
SHA256
c1c11100bcd322b98f4b4955aa2d16337b360061800cef9200ac9229b5cb8a37
SHA512
975bc39b0aa35060510d913d3b0d9497979837f527c5bb248dc0fd5a30cc313883bc3aef6e8e65de1e645d6df48d1675ea64a6865764550e379c6dc48c3e9709
SSDEEP
1536:DWkClC+QtF6M7IG1x4cQjPU/A4MeImZR3:SBYX6Mb4cQjAOeI03
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
39c8b25cecfc249e7f392614586f1687_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ