_LOADLIBRARY_DUMMY
_RunAs@16
Behavioral task
behavioral1
Sample
6049a11d462004324f8c66a7696abcca_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6049a11d462004324f8c66a7696abcca_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
6049a11d462004324f8c66a7696abcca_JaffaCakes118
Size
34KB
MD5
6049a11d462004324f8c66a7696abcca
SHA1
6758046b268b4ac74f8684849ca0678f9e06109d
SHA256
b1c8eda63f91472bb57afff0dc331c878546d11d18b93dd11c57127eb46e8066
SHA512
90650eb2abda6bef2891535c2e69fce943451b21f5ae20f6bb94c1a4c7adba5f97d3b84867c84e62f70103a4969ec0047877c1dc640a8353c4cc17da669eb16a
SSDEEP
768:wgeUxHpbt4Vw3N0e2YkDVjK4trS2x7SoI/9WOBw61PafhCnbcuyD7UAfa:wxUHt4Vwd0nYSZJko6FC4nouy8Afa
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
6049a11d462004324f8c66a7696abcca_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
_LOADLIBRARY_DUMMY
_RunAs@16
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE