PlgDestroy
PlgGetDirectLink
PlgInit
Behavioral task
behavioral1
Sample
2f6c70b0b1f9aef8275db208bdf2e15c_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2f6c70b0b1f9aef8275db208bdf2e15c_JaffaCakes118.dll
Resource
win10v2004-20240704-en
Target
2f6c70b0b1f9aef8275db208bdf2e15c_JaffaCakes118
Size
30KB
MD5
2f6c70b0b1f9aef8275db208bdf2e15c
SHA1
eb75a28cf727c113ac68524fb2fc56bcea82cd07
SHA256
955bc2b1267520810b4510927bf1905403b550e838a9ec18abea565395229bed
SHA512
049078a0b4d5135fa752174daf2f9557e01f1cdc758b2b3a3155d4e91dd980d4654be1878595985030fed1553c4712c80baa6435497a8635819e7bcbfeaa0e99
SSDEEP
768:DwPmIX2ia7O8+z9KJn1io99Dd8Y3PtEScQvZcxh:DweIm3WwgAX3PiiZ4h
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
2f6c70b0b1f9aef8275db208bdf2e15c_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PlgDestroy
PlgGetDirectLink
PlgInit
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ