CancelDll
LoadDll
Behavioral task
behavioral1
Sample
555e43f7c8825aa0950984b008e9df75_JaffaCakes118.dll
Resource
win7-20241010-en
Target
555e43f7c8825aa0950984b008e9df75_JaffaCakes118
Size
72KB
MD5
555e43f7c8825aa0950984b008e9df75
SHA1
210a27f381435b37fa7fdfdc007211ca514ac48e
SHA256
9f40576f35717be2784eb38f1d245021b2744572aed4fa144ce3a94605e291f2
SHA512
253e9c76e803e3a6f0933d683ac08e293fb9226f902e05d10f9848ba3733ead2e449ac6d5abde690dffeb33fff3c3bce070f7ae611140e53bffda24820f0e72b
SSDEEP
1536:EdNs9O6qwtr21l6TcEVyGR6jZw+6g7N9sCcz9sqoon3OKHO95ZfQzi:EdNs9O6rryCRwN0C9cHOlom
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
555e43f7c8825aa0950984b008e9df75_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ