DllMain
WSPStartup
Behavioral task
behavioral1
Sample
e8331bde6824e8812a9c85fb60d480c9_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e8331bde6824e8812a9c85fb60d480c9_JaffaCakes118.dll
Resource
win10v2004-20240226-en
Target
e8331bde6824e8812a9c85fb60d480c9_JaffaCakes118
Size
10KB
MD5
e8331bde6824e8812a9c85fb60d480c9
SHA1
45723b7084bde2eab064543aede91492f9348953
SHA256
5034a9c0c20843c0a054c6795e6bc4dc9c5274ea6be544c8b93a626901148070
SHA512
3defa140b0d24caf9f0863ea8155916c06d9fed59a3b0f065e80ddccd4e2e2810c0d036678eed2c36feae5e436337e6dc268d6008d5386189aaf9c4d83f9ccc5
SSDEEP
192:LEjokRxrW5L/DwO8ZN/L7PwRt1XTd1GrahXC5GE+j/NCmL8Pb5DNXE+CL:LEjoEA5ja/L7YlGrKCsFj/Am8P9DNML
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
e8331bde6824e8812a9c85fb60d480c9_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllMain
WSPStartup
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ