CancelDll
LoadDll
Behavioral task
behavioral1
Sample
568298ebae869197fe5ca3d46f4bc08f_JaffaCakes118.dll
Resource
win7-20241010-en
Target
568298ebae869197fe5ca3d46f4bc08f_JaffaCakes118
Size
53KB
MD5
568298ebae869197fe5ca3d46f4bc08f
SHA1
4104d81f6a55bdc82519994c4becd5e6d280d98a
SHA256
dbcfbc7503fba7a221378ff2ebeb20df267f2f0c44872f43402770d2f1f6b4d1
SHA512
14b582310b92055e6508c421abd5e37943800c985ea8f76c9cbf4086deaa7d57b09e13d7ea47998b614e2b1f90544d0823136e582a1e834c7227152f6413d84c
SSDEEP
1536:wAceoINVALKED9ptt6QDMx9bJpo+yg5FRwYGy2yXya:wAcTqG3psDNp02FR5fUa
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
568298ebae869197fe5ca3d46f4bc08f_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ