CancelDll
LoadDll
Behavioral task
behavioral1
Sample
3e92fc7b197305bc917e33d40528f3ed_JaffaCakes118.dll
Resource
win7-20240903-en
Target
3e92fc7b197305bc917e33d40528f3ed_JaffaCakes118
Size
69KB
MD5
3e92fc7b197305bc917e33d40528f3ed
SHA1
9147c1f49b673e3280c943cc16d595c197ffec18
SHA256
6c0a1908d44cbdc3f196b2ec935b1b2ee1ef13b0b482cde5cf6d7be9ee2e0f61
SHA512
1cc4fa413d139d0e0fba73092ba5ed7b8f3140bbe21ea1b394f8eff5f5e902ab1028687b59dbbfe13697dddbbe7686ecb45f35389f3a1dd313231a81538e68c2
SSDEEP
1536:VOzB/iUiDI+6dqx6LuO9Ed6eSxObcSh6k9gM3tv/4Vo:VK/iVDr0qxu/9Ed6egShCMdv/4m
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
3e92fc7b197305bc917e33d40528f3ed_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ