DriverProc
modMessage
modmCallback
Behavioral task
behavioral1
Sample
7769b8cf8efd6a74e3c975cb70542aed_JaffaCakes118.dll
Resource
win7-20240704-en
Target
7769b8cf8efd6a74e3c975cb70542aed_JaffaCakes118
Size
5KB
MD5
7769b8cf8efd6a74e3c975cb70542aed
SHA1
757092d22567cce5087f56a47760e04fcbb2bec3
SHA256
2c8963ca3bc091b8f1383fdb92c28e5ee9728489cc45ebb6dcfbbc79e55fd844
SHA512
06b03b8c333b11ece349468fe014ef68abd57d7e5ef9b46e6f6eba600cdc89e5bfe61386f40436c9e148927d62e6d91cf34d24bb28c77c1202cf3efb2ae8eeb4
SSDEEP
96:oCTr7PdqAG4lFzxo0oHdRirbfhze8eQuRrIpraxG:ocVqAllo0o9gHfh3eQuupOxG
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
7769b8cf8efd6a74e3c975cb70542aed_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DriverProc
modMessage
modmCallback
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ