InstallU
PluginCommand
PluginMain
PluginName
PluginType
PluginVersion
WSPStartup
Behavioral task
behavioral1
Sample
6f9d718d937c0746ebccb5c065eb7394_JaffaCakes118.dll
Resource
win7-20240705-en
Target
6f9d718d937c0746ebccb5c065eb7394_JaffaCakes118
Size
97KB
MD5
6f9d718d937c0746ebccb5c065eb7394
SHA1
273fe3abb8d9d37e440d9b77d025fbbf36248986
SHA256
3bdb8b58e5f5b44f561b01a73e6bc11d5b5a4be4dc6b9076a5ab85a9abd35007
SHA512
839a545e2d3b3ec3dda0228b21d983d82ac35b8a3a9f2beb270cc712e4343783b0390767bf5e31d71d2b1503b6427a2c0c301134eea096dcabbb02bcebdf2461
SSDEEP
3072:cGIFAKBaO7kkVqF2D+s2M1HvV7N0V3ld5QZA4:HABdAwK7zMBVI3li
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
6f9d718d937c0746ebccb5c065eb7394_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
InstallU
PluginCommand
PluginMain
PluginName
PluginType
PluginVersion
WSPStartup
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ