DllLoad
DllSetEvent
GetObjectWithConfig
ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
f20f5d6d50f5c1141dabe36099c4b666_JaffaCakes118.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
f20f5d6d50f5c1141dabe36099c4b666_JaffaCakes118.dll
Resource
win10v2004-20240412-en
Target
f20f5d6d50f5c1141dabe36099c4b666_JaffaCakes118
Size
282KB
MD5
f20f5d6d50f5c1141dabe36099c4b666
SHA1
ab1602ad6c010a5788218b5aad3ff6fabf3bf099
SHA256
e41dd5000d2b477017183dabc194a70f4adfcb59238b384be584da6109ddc3f2
SHA512
cab648f0978f687831b824d21aab3c7d2f79ebb1c2ddd1f171f6ee8c7dc4205a2470a0c238ca1b72cb86c7e68fb8232c7a7ad0f2086a2c20fceb0a161cd73c55
SSDEEP
6144:KfbS2avCUH0ak3zZrJn6z5c5RuA9lq7A9/YGzlT7t/PMnlaCA79ZbE3:Kf2pCUu3lrJn6VcmsCGdSlq9Z4
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
Checks for missing Authenticode signature.
resource |
---|
f20f5d6d50f5c1141dabe36099c4b666_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllLoad
DllSetEvent
GetObjectWithConfig
ServiceMain
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE