RunSetupA
RunSetupW
ServiceMain
Behavioral task
behavioral1
Sample
32d99806c94754f5fb6716e3fbb49e71_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
32d99806c94754f5fb6716e3fbb49e71_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
32d99806c94754f5fb6716e3fbb49e71_JaffaCakes118
Size
47KB
MD5
32d99806c94754f5fb6716e3fbb49e71
SHA1
f134b8fe0feccfe44aa9ecd2044e2de5ba256af0
SHA256
586131a805ebeea9257676e771fe37d81f439036d015c5dee99e9e46b5471c1b
SHA512
33c54e204a7ee6da13a8e99f1e772d880702bd2941b3dd2f243eb0d2445467486a1c595b5994841e099f9e66d562d5e974afbcddfc1f66707814581cd3e9c1ca
SSDEEP
768:6hHK8t6R0QZARVveV6Akx9E+WtzQqaYvvWICIQavnzoxrWM7Vw4Eu0C9xjuW2:iHKfzZAH81kytkqa2vzrQwzoxXL9bxZ
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
32d99806c94754f5fb6716e3fbb49e71_JaffaCakes118 |
unpack001/out.upx |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
RunSetupA
RunSetupW
ServiceMain
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ