AdjustBottle
ClearBottle
ClearMark
CopyBottle
FreeKill
InitKill
JudgeKill
MoveDownAll
RndMedicine
RndVirus
Behavioral task
behavioral1
Sample
172b6f5173fd79253f20e085b502e229_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
172b6f5173fd79253f20e085b502e229_JaffaCakes118.dll
Resource
win10v2004-20240226-en
Target
172b6f5173fd79253f20e085b502e229_JaffaCakes118
Size
192KB
MD5
172b6f5173fd79253f20e085b502e229
SHA1
bd65b84fe9ae7f58174193a285bb0b9814f105c0
SHA256
f39f3ac1a3b2b0829e908f8974aefc50f0313b44e8141ea7b187537b2a234fe9
SHA512
dadbc50eb4ffbe2c459759e5cc6e2ab2315532c4b358e5180764c26f5f01155e55e32c00d90063d0008a25ed0c0f9045f8e8f5779a8af0d02e2469159f07b83c
SSDEEP
768:zneXXOcFPqSEvk0kD0OL6syKhbBDozaZ120mdtd:zuxPqSEvzQOspBsw2
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
172b6f5173fd79253f20e085b502e229_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
AdjustBottle
ClearBottle
ClearMark
CopyBottle
FreeKill
InitKill
JudgeKill
MoveDownAll
RndMedicine
RndVirus
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE