_LOADLIBRARY_DUMMY
_RunAs@16
Behavioral task
behavioral1
Sample
48cb702a6663ec50dece0c2cd7e49628_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
48cb702a6663ec50dece0c2cd7e49628_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
48cb702a6663ec50dece0c2cd7e49628_JaffaCakes118
Size
34KB
MD5
48cb702a6663ec50dece0c2cd7e49628
SHA1
326a18946de15fc18080cfec8f7eb31045a89143
SHA256
0bc1ccf0087b869f201a5b8357ac64204f192876e09b765c3285723e56b6ee3d
SHA512
666d7683c7f20545d4913a05db2456616d26abbf2ef8ada41a740a50a40c9b32f2fe03f02a3299672a715641a138b94366eed8e3364159c55896b1f39d9ce0f3
SSDEEP
768:hF//irx6yMUAmx7UyckWikFhzSeKUcVWYcLrP++z3yb3oXnbcuyD7UwCq:hF3id61m3ckVkHSeKUK/ce+zCjEnouy5
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
48cb702a6663ec50dece0c2cd7e49628_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
_LOADLIBRARY_DUMMY
_RunAs@16
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE