CancelDll
LoadDll
Behavioral task
behavioral1
Sample
4151400331f33ef8f18a38a1ac1bad6b_JaffaCakes118.dll
Resource
win7-20240708-en
Target
4151400331f33ef8f18a38a1ac1bad6b_JaffaCakes118
Size
59KB
MD5
4151400331f33ef8f18a38a1ac1bad6b
SHA1
c97cb2bfecd80e56674f3141e66913412bd67360
SHA256
ede97f1f626660cc032083f4f857bb0ba68b3f2a9f987f3912c4d8603edc4497
SHA512
fcec6339a0ee34e6d05f369f7a84a0af4738f4d5bc6ebfe018e099ef83e4b67d1d15fca6ddbe18c6995d7693d05fa4a0256984383eb7a593034009062cf3ddb6
SSDEEP
1536:yjJMzqRhEZLaW9nKSETm5UIc4XGiNky+MCSLjve60:ObEJaWVcTcbXGOky+MX0
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
4151400331f33ef8f18a38a1ac1bad6b_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ