SchedServiceMain
ServiceMain
SvchostEntry_W32Time
Behavioral task
behavioral1
Sample
2a0d87c24899dfc09f9b048959a4cf4c_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2a0d87c24899dfc09f9b048959a4cf4c_JaffaCakes118.dll
Resource
win10v2004-20240704-en
Target
2a0d87c24899dfc09f9b048959a4cf4c_JaffaCakes118
Size
307KB
MD5
2a0d87c24899dfc09f9b048959a4cf4c
SHA1
dd680c0d16820cba52745817b386a89d6258d3e9
SHA256
287b44aef9e6f691fc1e0ec347501d8441b116a4aebf425a88a5893b65373cef
SHA512
7b86bba484fde5f22197c6134a14f635e360ad1fac9e3906ddd2e21cff5182c0f8543e52fb614f0a4730e2b2181978766b34025c2e07791c8c1c069d7854ee33
SSDEEP
3072:asGdZNtcW34Cgg7oNCVFsRjTaO5dIkwVM5vp/JD7he/qxratW4YjO5QNeBSj1id1:E7x4g7o5wVMVphDZtCSjufsO0BL7VPu
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
2a0d87c24899dfc09f9b048959a4cf4c_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
SchedServiceMain
ServiceMain
SvchostEntry_W32Time
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ