CancelDll
LoadDll
Behavioral task
behavioral1
Sample
53962443808e10150e2aeb63f30b9f38_JaffaCakes118.dll
Resource
win7-20240903-en
Target
53962443808e10150e2aeb63f30b9f38_JaffaCakes118
Size
48KB
MD5
53962443808e10150e2aeb63f30b9f38
SHA1
d68b5a7a0426170d44728a59300a46432bafcf34
SHA256
f2d72c02497a5eac226e5bfb276c90b00d516288bd995138100888e2bd9a3f98
SHA512
474c8dd871e3242441e219698cca97d9fa7e3d725c9756184ec4b23257a038ab2337f7f5fbf4b31e4c1cdc230289f37c095cf7d74fd3c5a449d2cea12f069ad3
SSDEEP
768:e+TO5SxTOEq/CRjUHoe59Xc31vHS/6kk2PWUaLUUmOWroc+KsFF8w8OBiF:lTESkEqKCHoe59Xc35HS/6LJYiFiL
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
53962443808e10150e2aeb63f30b9f38_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ