ImaginePluginGetInfoA
ImaginePluginGetInfoW
Behavioral task
behavioral1
Sample
3a1f5e7a677eca056abee7e5f041d93a_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3a1f5e7a677eca056abee7e5f041d93a_JaffaCakes118.dll
Resource
win10v2004-20240426-en
Target
3a1f5e7a677eca056abee7e5f041d93a_JaffaCakes118
Size
39KB
MD5
3a1f5e7a677eca056abee7e5f041d93a
SHA1
66b0eff06c6b43874555f53ea73c0fb86fac9e11
SHA256
eef224566e8c3dc341ee3404bc2f40aaeb1c094e69b793ccacf8fa9b1d2ed0b8
SHA512
2f1837e58cbaac94f06e36b16ea3e445f3cb1c424f564d874095dd44d273674e0531ba165e4745e16a8d6238320e8f437270b49000a24917fd8be47005236669
SSDEEP
768:01XlbVwDQr59KxToAlhyDY+rIqHt7lmxDNnD0dhH7G1npZ/cwpmRa4g4:01XlewCTouhyjrDN7linD0dhiJpZ/xgr
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
3a1f5e7a677eca056abee7e5f041d93a_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
ImaginePluginGetInfoA
ImaginePluginGetInfoW
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ