Start
Stop
Static task
static1
Behavioral task
behavioral1
Sample
fe4f02e9c5b2dce56c27ebad7f150e29_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fe4f02e9c5b2dce56c27ebad7f150e29_JaffaCakes118.dll
Resource
win10v2004-20240412-en
Target
fe4f02e9c5b2dce56c27ebad7f150e29_JaffaCakes118
Size
44KB
MD5
fe4f02e9c5b2dce56c27ebad7f150e29
SHA1
40d5407bdb64b19b87a733eda431cfb28049a672
SHA256
5103edf3618626c4a56ddecfc165eb57dc64281c163f8041671c69f4c004ce90
SHA512
d33e4e63b7a405329fbb403b5e41543607fb7d05438de7f0538b5a96ebff0d66b57733240576903bf5735c4cca1833adff965daba3d0cc553c9e73c3a920154e
SSDEEP
768:dFdih8MPcyW0okWtsyokXUd1EgY+WxYIpU/GTHi1Kf0F4fJqEBaEnb5GDtk:dFdmlckWboy01Y+z65Hi1y0cJqEBa+bb
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
Checks for missing Authenticode signature.
resource |
---|
fe4f02e9c5b2dce56c27ebad7f150e29_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Start
Stop
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE