CancelDll
LoadDll
Behavioral task
behavioral1
Sample
5506c9e2ac8c7b3036231f8d9a729570_JaffaCakes118.dll
Resource
win7-20240903-en
Target
5506c9e2ac8c7b3036231f8d9a729570_JaffaCakes118
Size
70KB
MD5
5506c9e2ac8c7b3036231f8d9a729570
SHA1
23efeafcbd984ecfc3b2848d29115dbe1a85f59f
SHA256
bdf89bc39890b61db498f06e00e72c6ff5971a3a307e663ed86dea5760f746bf
SHA512
f68b87e6487fd3c5cbae8c96641147b8f7c31ceb90b47753cf9b807fd6192010aca768af358ae23cf4f4ce98d4d0b41c9fb7c3daf1cc5bb37ae027f45827b629
SSDEEP
1536:V7LV29Z+qXfobtPVDQgekAfFaypJnGTXLen/dIeAJvUfeC3QXi/A:FU9Z+eoRdQg+hpJyXedIhJcfemQ0A
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
5506c9e2ac8c7b3036231f8d9a729570_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ