CancelDll
LoadDll
Behavioral task
behavioral1
Sample
3a87cbf5b9b38f563ae27beaf33813b3_JaffaCakes118.dll
Resource
win7-20241010-en
Target
3a87cbf5b9b38f563ae27beaf33813b3_JaffaCakes118
Size
59KB
MD5
3a87cbf5b9b38f563ae27beaf33813b3
SHA1
06b98ab2a4948b4e5d9f54398d735b2deb05693f
SHA256
b146febd169ad11c7ff96f782f5ed7e7342199a0b924fbfeefdfeaae6e848f47
SHA512
d7f9ae6582537a1cb5b9e6aaf2da02644ca3311cb6d88f466fbbb6562f13edcde7804b4f61867a5b788717af3c9883f4ba5cbceefc2109628a1121f24675ccaf
SSDEEP
1536:O/S08OVN/9MzTuCQO2+Sp6nNkDja+WSVFn:O/S08OVN/9ka+SykD20n
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
3a87cbf5b9b38f563ae27beaf33813b3_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ