DoWork
Install
RunOnce
Uninstall
WSPStartup
Behavioral task
behavioral1
Sample
2e4f881d25fd99d172c226475686602c_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2e4f881d25fd99d172c226475686602c_JaffaCakes118.dll
Resource
win10v2004-20240704-en
Target
2e4f881d25fd99d172c226475686602c_JaffaCakes118
Size
29KB
MD5
2e4f881d25fd99d172c226475686602c
SHA1
e612b868dc31debb251468bca34db6743dab5c86
SHA256
f95e3afd442091869d80dfdf085b69b5ce0bf01b5e3ce6718cf06c40e07fe316
SHA512
1e2a6d7663c778f4af49908a882fdab388143c2c457cab7d5afb96bcb1abf01e33a2417b83a9af8cbd3ef493ab0158f46fc983ecfa957947f8c2025f62a97b25
SSDEEP
768:dMsSI4MFkRfc6S4/Jx64PoPR79jc4z58vfvgkruz4:dkI4M2jfW4q79jjzwokrU
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
2e4f881d25fd99d172c226475686602c_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DoWork
Install
RunOnce
Uninstall
WSPStartup
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ