CoPluginFree
CoPluginInit
CoPluginOption
CoPluginVerion
Static task
static1
Behavioral task
behavioral1
Sample
36d227cc4bf35f3b605f8a885c22c96f_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
36d227cc4bf35f3b605f8a885c22c96f_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
36d227cc4bf35f3b605f8a885c22c96f_JaffaCakes118
Size
132KB
MD5
36d227cc4bf35f3b605f8a885c22c96f
SHA1
8e00dc893853bcd205fd2f9a8f675a7d1ea18355
SHA256
c7c35ca804bc019d0febe0d9a9e1792ecf2839ae6f15bd9e68fc2b717a5a013e
SHA512
e5eb69cecea61ed98165a04e5ac42d890656d5768bf166a5b529334791a954d8b6ab2bd140959062057dc43daaafd4f84666b06b3b8a80feda31d340069c821a
SSDEEP
3072:EsVGXXYxHeYibfGqtcsumAIfB4sYOzj82hOPLHeKmmEUJ:1L+dOqCFwBQOzj82jUJ
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
Checks for missing Authenticode signature.
resource |
---|
36d227cc4bf35f3b605f8a885c22c96f_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetProcAddress
GetModuleHandleA
LoadLibraryA
ExitProcess
MessageBoxA
CoPluginFree
CoPluginInit
CoPluginOption
CoPluginVerion
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE