_LOADLIBRARY_DUMMY
_RunAs@16
Behavioral task
behavioral1
Sample
4134c966396a26d9e16d59e1f1b865ef_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4134c966396a26d9e16d59e1f1b865ef_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
4134c966396a26d9e16d59e1f1b865ef_JaffaCakes118
Size
33KB
MD5
4134c966396a26d9e16d59e1f1b865ef
SHA1
8177b1ec95f585bb3a8b27d9dbbac8f921ded979
SHA256
de5b0a5e2e7bbabad207435c642dcf533ce56187a50966b8676469e48251009f
SHA512
9bd60e6a5c9741e1441d0203e07360143c3935029dfe6b6fce23a31d7174c8c83530c2c67570e3c5219d85028eed3039f4864a67605121967b461987157dc594
SSDEEP
768:9oO6Z6JjEHDoa0PMvbO35LTmbnmTFnCZww0JWnbcuyD7U0uf:iO6wJwjo/sS3Nmjh+vUnouy80uf
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
4134c966396a26d9e16d59e1f1b865ef_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
_LOADLIBRARY_DUMMY
_RunAs@16
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE