@$xp$6TForm1
@@Unit1@Finalize
@@Unit1@Initialize
TMethodImplementationIntercept
___CPPdebugHook
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Behavioral task
behavioral1
Sample
5b7cf56878dfba548b5f0a94411fffcd_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5b7cf56878dfba548b5f0a94411fffcd_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Target
5b7cf56878dfba548b5f0a94411fffcd_JaffaCakes118
Size
4.2MB
MD5
5b7cf56878dfba548b5f0a94411fffcd
SHA1
87fa9af71703e4749dee146bba4454ec34412650
SHA256
0c20f9da457956b7ea5e0f0ccff18b8f5af892b19e2614e933f56d63d06a0ad5
SHA512
54af3341ee958e65ec027619e45dba1d4415f4c6ded60c9060da916ff7d225b65a10058a90231caf8d9b2bd1a16854527a025f2e3e3ac9a913458bfc07b1f0c1
SSDEEP
49152:rqQTrfOM5m10SPFRnt4vH1H42uBZ/E9YTdQ/:rTr5os142uBdQ/
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
5b7cf56878dfba548b5f0a94411fffcd_JaffaCakes118 |
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
@$xp$6TForm1
@@Unit1@Finalize
@@Unit1@Initialize
TMethodImplementationIntercept
___CPPdebugHook
__dbk_fcall_wrapper
dbkFCallWrapperAddr
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE