load
update_load
Behavioral task
behavioral1
Sample
2498eec1947367d8ccbb20e35de2b1b3_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2498eec1947367d8ccbb20e35de2b1b3_JaffaCakes118.dll
Resource
win10v2004-20240611-en
Target
2498eec1947367d8ccbb20e35de2b1b3_JaffaCakes118
Size
88KB
MD5
2498eec1947367d8ccbb20e35de2b1b3
SHA1
fd8402f5ec55841e0f624407d81cff076d4567b2
SHA256
7e2f66f835d85d913bec0be7fea3c79f1ee0c7b0b87006a61a99e4b3d7b1947f
SHA512
759e4125151f4296bd356e83480bc9f755eaa3f942847be018ebe6bf1c306c7ea688b15116f55b8b099f728d098634c00d840ebc19f419d00d3cd4825b106936
SSDEEP
1536:q7LvpBrAfqAqhbgu6WK1oNT8G2tf/C8h0lz8ojAZFs35LwCNK:q7XkfqAsyPi8GMXC8elICAZvO
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
2498eec1947367d8ccbb20e35de2b1b3_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
load
update_load
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ