InstallU
PluginCommand
PluginMain
PluginName
PluginType
PluginVersion
WSPStartup
Behavioral task
behavioral1
Sample
821c843fcd9e390cd49fc9a49cec4df8_JaffaCakes118.dll
Resource
win7-20240704-en
Target
821c843fcd9e390cd49fc9a49cec4df8_JaffaCakes118
Size
98KB
MD5
821c843fcd9e390cd49fc9a49cec4df8
SHA1
e124a30cbfd39b1f797cf77fc2d8408351b1e00b
SHA256
72e9e46cd43b5b976f18c481866313ce252ac5dd79a5b05ae9cff5444a64fd92
SHA512
216a260b2b79212430f3906bbd961ce21c02cd4d1d28d0ec0511fd921f18d847cab31f5e1ff7e5b07cbe2565865dcb4c7cef82abe25eb2b96eaf452e870f7ea2
SSDEEP
3072:WoTywKVnuASLEX2j2ZcDJ33YG891rILGi:WXGjGcDtp89BIL
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
821c843fcd9e390cd49fc9a49cec4df8_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
InstallU
PluginCommand
PluginMain
PluginName
PluginType
PluginVersion
WSPStartup
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ