CancelDll
LoadDll
Behavioral task
behavioral1
Sample
566c2ac66f2bc74f17ae7563ba63d108_JaffaCakes118.dll
Resource
win7-20241010-en
Target
566c2ac66f2bc74f17ae7563ba63d108_JaffaCakes118
Size
47KB
MD5
566c2ac66f2bc74f17ae7563ba63d108
SHA1
378c45f128f9fbca6f59a398952ee5ad4d8b95f8
SHA256
f4d6ff0422f4e8cc693337710bc9e9edd3f1af8532d71d840d2add5ed8e38d49
SHA512
fc9a3d31e2a72db1e55750572338514ffe557afc6352148fe3deaf501fb42a1ac8d90af1598e8e0b86b30dc92ea8c31e7f57065b0a7e166fadec47d5750d8723
SSDEEP
768:Yb/oc3OokLfNVJ+Lrc2c4ogThRUmc4iRzTAcwLo30gNYgyNBhFdxg:wAceoINVALJ1bpcNGqNYgyNBhFd+
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
566c2ac66f2bc74f17ae7563ba63d108_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ