SchedServiceMain
ServiceMain
SvchostEntry_W32Time
abc
explore
Behavioral task
behavioral1
Sample
286f46410852ae9bb70b738bcb3f842a_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
286f46410852ae9bb70b738bcb3f842a_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
286f46410852ae9bb70b738bcb3f842a_JaffaCakes118
Size
181KB
MD5
286f46410852ae9bb70b738bcb3f842a
SHA1
175d1379af945c32dc95a1c42fd6181e18f1d2c1
SHA256
a098635451b771e6240de79cdab9af70afcd64202fde4c5cc58e68e256ee5d11
SHA512
cfddf8c5cbe6448b655c1587884179a465cbba2115e937370b25fc5325c9d59d4a6e99d8caf9170673e344a68f0bf017753ec89dba87787c31964e980e0ec15c
SSDEEP
3072:pJSiTazdD+icCg7TaOw89v3jLJynZcgjdBI4CU9H/tou6BA8o3BZT9G1Mk:/vCdxeJwcv3jtEBIxUpfoo34
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
286f46410852ae9bb70b738bcb3f842a_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
SchedServiceMain
ServiceMain
SvchostEntry_W32Time
abc
explore
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ