TZOSignOff
TZOSignOn
Behavioral task
behavioral1
Sample
7658ec7f8581567c825bde36142e5341_JaffaCakes118.dll
Resource
win7-20240708-en
Target
7658ec7f8581567c825bde36142e5341_JaffaCakes118
Size
16KB
MD5
7658ec7f8581567c825bde36142e5341
SHA1
3376bca1b5dbd16c3532cad2dca6b40d79f5456d
SHA256
956150246e2ae4cf20e71827d33c28a9fbb518ffe0f9cb002902b3ff0fcef497
SHA512
47c71e4f77ebfa408339a16e154a140f9a2af8bbe2e9be54b0ddd622411f20c1947dec6e7a6afbdb246ed18f9c6d7c40449d7834003403eac9ce832b2adc9aca
SSDEEP
384:V0kuC+MUj5gnrnzLZ3YJVMKibBKToYTlWz:VHyYH93YJVyw9RWz
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
7658ec7f8581567c825bde36142e5341_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
TZOSignOff
TZOSignOn
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ