CancelDll
LoadDll
Behavioral task
behavioral1
Sample
52322af5158a74a4ef8b3fa2eeef2016_JaffaCakes118.dll
Resource
win7-20240708-en
Target
52322af5158a74a4ef8b3fa2eeef2016_JaffaCakes118
Size
75KB
MD5
52322af5158a74a4ef8b3fa2eeef2016
SHA1
0aaa3e7cbc04167366bf29a8b670eaa915252fb1
SHA256
025123e8d0ee565782f0844d242272d8e8e6ee4a91c003da070da7a8ba39f986
SHA512
1678de1d0930c47b400a3780b492823b774d44c951ab52a447fbf9f697670eac5f17d6cbb85b59ce73a4b3c71f0906a12415dec7fef5046fd7c27530aa1c1eca
SSDEEP
1536:DVV1HTuRpx4oGgRX15+I5cZaPJD0kTC18echV1pJrBPmiFkkwqlZnd29K:DVrKLx1RXr+I5JJoL18PhVHPmwkpqdQK
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
52322af5158a74a4ef8b3fa2eeef2016_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ