orlrkpmhqsn
tqzenafu
wbhls
zgnbtmts
Behavioral task
behavioral1
Sample
32c5c0882814034e7e2292fc82462379_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
32c5c0882814034e7e2292fc82462379_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
32c5c0882814034e7e2292fc82462379_JaffaCakes118
Size
277KB
MD5
32c5c0882814034e7e2292fc82462379
SHA1
4f96b9df07266bd725fc6ca4a10d72564134d2ce
SHA256
00c1f057588b328a726a1b69232e15a7687df766ebc40b98afef18fc6009b2f2
SHA512
89619d7f9881b3c16db7d0db64ee72b3413de6020c19efd8c4e2b1791704e73fd5e415dd29d265f4134c3f444cf6fb46513a201090c2aa42600874606d59fbff
SSDEEP
6144:xCiF1oHiIfe86vCZsaVhUzxpAaDPC+7vppBYpZVj60/+tXrhmoSU:xvFKfe/EiXDK+HGZVj6z5hmoSU
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
32c5c0882814034e7e2292fc82462379_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
orlrkpmhqsn
tqzenafu
wbhls
zgnbtmts
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE