CancelDll
LoadDll
Behavioral task
behavioral1
Sample
44fd6eec7f70d9f0a84d30f88ab74580_JaffaCakes118.dll
Resource
win7-20240903-en
Target
44fd6eec7f70d9f0a84d30f88ab74580_JaffaCakes118
Size
64KB
MD5
44fd6eec7f70d9f0a84d30f88ab74580
SHA1
38b590f3608635db362c0aa78b9bcbbc89e98a80
SHA256
5509e89397d4960333f116e0dd082398173239c74b0ef236e3687bf67c568e97
SHA512
42ad25751dfde40d4b1432596e3c26979dad58088ec93ba90fba97feb907b4ede780b07d61aa3b61d54211377eb180115c4463ee61300f7843f2b53b48b235b7
SSDEEP
1536:yok0mU99EfW61RUY/gBPT8bglrMvvJ2YgGs8XR74lRy:/maWRUYoBobZYTPu7Sg
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
44fd6eec7f70d9f0a84d30f88ab74580_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ