_LOADLIBRARY_DUMMY
_RunAs@16
Behavioral task
behavioral1
Sample
0b49d1df02fc0f1811f779697ab5b4f5_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0b49d1df02fc0f1811f779697ab5b4f5_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
0b49d1df02fc0f1811f779697ab5b4f5_JaffaCakes118
Size
38KB
MD5
0b49d1df02fc0f1811f779697ab5b4f5
SHA1
2e9dbe524ea36d0efb110c7f709fc81d49f0c871
SHA256
c98f347a54e3b50b21cfc6a1a24703111a8c9055ed8f5fefaa51e779be730943
SHA512
1f4e3afacbcd10053c1c1e0745075df0c14278c322dffd0d6eff5bbe60151a3de6427de8260defb5049e11d2b5e299d4f0d2afa993e6f46dd2199cbccb2b0331
SSDEEP
768:X72EtfWfm+ZgTlShj1dESUOpP7KqjHEMc72pUnbcuyD7Ut:XSMfWOMQPSP2mH1ciUnouy8t
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
0b49d1df02fc0f1811f779697ab5b4f5_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
_LOADLIBRARY_DUMMY
_RunAs@16
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE