SchedServiceMain
ServiceMain
SvchostEntry_W32Time
abc
explore
Behavioral task
behavioral1
Sample
253826a8a87b717c0f0bb1ac86ddbadd_JaffaCakes118.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
253826a8a87b717c0f0bb1ac86ddbadd_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
253826a8a87b717c0f0bb1ac86ddbadd_JaffaCakes118
Size
192KB
MD5
253826a8a87b717c0f0bb1ac86ddbadd
SHA1
bd56ae78987fd9490f0ec8e4b7d41020e9417746
SHA256
ea9c1c4ef3eabb278a387220860fe12e68a1d8a6a41fe7990a6b80bd136ecddd
SHA512
7a02a6c41d1ec4790e765cbeae7f3949e656c39246896d607f1718e85cebb9b282df167a8db4e12b45cf4cd3b1c2a623956a02cee2f99a1864bc2ac47da060be
SSDEEP
3072:y/HJ7wbf+bedJlnpMoY7fGssQYzIBo7/7JAYohbth4o5Bzz4GsRWkId7M1DAVU:ASEeJW7fs3LAJthf5xz4GPVU
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
253826a8a87b717c0f0bb1ac86ddbadd_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
SchedServiceMain
ServiceMain
SvchostEntry_W32Time
abc
explore
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ