_LOADLIBRARY_DUMMY
_RunAs@16
Behavioral task
behavioral1
Sample
0e145fa7d1c9400662d1edc412d8c188_JaffaCakes118.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
0e145fa7d1c9400662d1edc412d8c188_JaffaCakes118.dll
Resource
win10v2004-20240611-en
Target
0e145fa7d1c9400662d1edc412d8c188_JaffaCakes118
Size
34KB
MD5
0e145fa7d1c9400662d1edc412d8c188
SHA1
be323c9dec3fe337974253f6fd85cbc62fbac1f0
SHA256
b04c08493957ebcc4b8885b056c7df3f1b6ee4b6e3d5e232b450e58608bf5e92
SHA512
15fc119d50972e4c843b7001f0265a274bf2df44ddfdcc0cf7b87dc456ff3e2e1aede291b6bf231d650e3b4cbf86ab86871ce017cfe095db815869aba66bc735
SSDEEP
768:Goi34itYVsQHqVNJMJcP7M2MOIRGxMWaXE8qD+KU+1nbcuyD7Uwfq:ziIiu9heM2MOuEMWa0803UEnouy8wfq
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
0e145fa7d1c9400662d1edc412d8c188_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
_LOADLIBRARY_DUMMY
_RunAs@16
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE