CancelDll
LoadDll
Behavioral task
behavioral1
Sample
552961c2ac1d977090e91c52578b1129_JaffaCakes118.dll
Resource
win7-20240903-en
Target
552961c2ac1d977090e91c52578b1129_JaffaCakes118
Size
47KB
MD5
552961c2ac1d977090e91c52578b1129
SHA1
7481e34b9d6382da74469c7928335969314baada
SHA256
f6f866e95852d978fdd4c4c90a76262a243e2d1ad22823376d78ea9ffbf9a7e7
SHA512
03da82df770ee47da6989b1a1fd784a93d05f6698284f22601fbf5c68cf1f4979728a7cb4be1fe03a041e4eac4c78f6307414addba785b628c9021d9e371d1e6
SSDEEP
768:f9Rj9BP3wuJnKuULSBjLLLLLLLLLLLLLLLLLLLLgmtfspKTOCotniFNxswgPPWvT:zJB4wnVaSZUKCPiFKPOFDshS2AzdbN1L
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
552961c2ac1d977090e91c52578b1129_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ