CancelDll
LoadDll
Behavioral task
behavioral1
Sample
52d0210829e3e575ed45d4438479f0fd_JaffaCakes118.dll
Resource
win7-20240903-en
Target
52d0210829e3e575ed45d4438479f0fd_JaffaCakes118
Size
69KB
MD5
52d0210829e3e575ed45d4438479f0fd
SHA1
26a8e7041a94422f316b0c1dac4ea7e372e56f01
SHA256
d33cbc2ffd7bed5f7eb034a2a254732d0e5c26fb3287c2a2d10059745d3f3ae7
SHA512
fb4a15f62ee9d6a3e4e258e99fcf1bc12957affa2b6e22c25d3890bf10fbce91bdc9cc1c840efa05ff86080be482e1535e58b6b15ebeed085e23c58a88291e42
SSDEEP
1536:UomGm6wEUdazDlH712DVdO7eRRywtxwvg5kRFzf:Nm69fHcdO7wRLtxoySBf
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
52d0210829e3e575ed45d4438479f0fd_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ