_LOADLIBRARY_DUMMY
_RunAs@16
Behavioral task
behavioral1
Sample
3d3882007d5b9b0cc643b797441e4449_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3d3882007d5b9b0cc643b797441e4449_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
3d3882007d5b9b0cc643b797441e4449_JaffaCakes118
Size
34KB
MD5
3d3882007d5b9b0cc643b797441e4449
SHA1
84c2e3c3d62a20e4787f5b8c3afb122fa1813d8e
SHA256
835999681f06d4a0ffd8f8d96fdd88bfa0ce252e48e5f9d74b12e9b5fb8d8018
SHA512
4e0f907c7f8165d2f11ef32b0aaf596d7181df6d7c83a69d6b59841a1c9b83e54a50dc6bb00d94e4a1155a2318b5f6a56f1f350701e954ca0150573f6f44f018
SSDEEP
768:RgeUxHpbt4Vw3N0e2YkDVjK4trS2x7SoI/9WOBw61PafhCnbcuyD7UAfa:RxUHt4Vwd0nYSZJko6FC4nouy8Afa
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
3d3882007d5b9b0cc643b797441e4449_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
_LOADLIBRARY_DUMMY
_RunAs@16
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE