CancelDll
LoadDll
Behavioral task
behavioral1
Sample
5344a24c6c7f2ab849944fe527f30b49_JaffaCakes118.dll
Resource
win7-20240903-en
Target
5344a24c6c7f2ab849944fe527f30b49_JaffaCakes118
Size
62KB
MD5
5344a24c6c7f2ab849944fe527f30b49
SHA1
1cb70cd8cbf505aee4d45577c6c19f56a1c49eae
SHA256
ab3b404ba1ce159653a3ffa144b4e81e2ac9e79553c1c539a08c3d59c9922428
SHA512
c9609efeaabe4af2224878c40722b7dfe6f68d3c40331f9f58d1915d186d9926c54e721b2c460c9951b3758e53f54f2b10f4844627d64ff79a4dd9ef8274c6ab
SSDEEP
1536:DVV1HTKsxatBNsafUUBcZ2BjjhZMYRbK33f55JNqWj+tviTI:DVr/6BmO/cZ2BjdZMEbWfHOzmI
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
5344a24c6c7f2ab849944fe527f30b49_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ