_LOADLIBRARY_DUMMY
_RunAs@16
Behavioral task
behavioral1
Sample
0df39c8fab6201317afedc3fbc481a92_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0df39c8fab6201317afedc3fbc481a92_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
0df39c8fab6201317afedc3fbc481a92_JaffaCakes118
Size
33KB
MD5
0df39c8fab6201317afedc3fbc481a92
SHA1
02b8f4decbee3a2f5b34a19a33d16901c6279af5
SHA256
5213ac4f63da6976676b9c5a02f200b35a33066a66cec9f67ce51bb50493919e
SHA512
8bd923827112f91b272949c2fc79deaa25609c86d82302340a586ac1ecb763a95fe444106f7de836e19f2806b9e1c1d82f432e17f3b50e9d1f4c8a523132c0cf
SSDEEP
768:xc4WApBw9iwoln97Rljstgh2LlAeLguOAiOnbcuyD7UH:CQBwczvljQLlA5Snnouy8H
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
0df39c8fab6201317afedc3fbc481a92_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
_LOADLIBRARY_DUMMY
_RunAs@16
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE