Abram
F1122
Shown
Behavioral task
behavioral1
Sample
610613fa7732bf81c2a98e5479a0b180_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
610613fa7732bf81c2a98e5479a0b180_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
610613fa7732bf81c2a98e5479a0b180_JaffaCakes118
Size
181KB
MD5
610613fa7732bf81c2a98e5479a0b180
SHA1
8e9aca851098cccfe4b701466ae170214e0d25fe
SHA256
ebc2a69929e84bdfaca4fb3804240ab1ceaea69c6664cfa29442f6b52b31cef6
SHA512
094a9a512d7d7459f1c41479f5943f3f29df4a279b179a62edf8d473db6aa17d3fb173c5f43575bdc2d4800df64e4bc6560047ee423aca8c0892484656285a08
SSDEEP
3072:tBrNNeA7Flky1ZRWIhh+DNdoepSEvAMyzkmWK4Z2O+Q+1Iic6pcmdy0ZyPIouty:tpb7FlkevWFJdo2dyzkmWK4Z2OsWibpV
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
610613fa7732bf81c2a98e5479a0b180_JaffaCakes118 |
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Abram
F1122
Shown
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE