Cecil
H9922
Law
Quip
Behavioral task
behavioral1
Sample
8693a3964e0b2db4c41d1164c6433d5e_JaffaCakes118.dll
Resource
win7-20240704-en
Target
8693a3964e0b2db4c41d1164c6433d5e_JaffaCakes118
Size
158KB
MD5
8693a3964e0b2db4c41d1164c6433d5e
SHA1
bba2bc1f5b6ebd9381258536cebd4c6d3dd619d1
SHA256
049169b28fbd0a9c1ee1a363868fd9755c8eaae5252f1b7bfeddaaf7df9defc9
SHA512
4b88cd410b0a3b3c332286e14904d285a939f6f5bd4969149e46e444446583dd0c3d14d8e331f5f9789ee34999a09fc7ae2277b9bfdb744ce86d60874c9b7921
SSDEEP
3072:LViq9SoMY/ddQaTX3AlEZtw9T0wTeu8WbZFVw6UyFBABz3w6oUUaSvou1h:ZR9SkQ6X3AlaaMLWbZf4yFk3yaioW
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
8693a3964e0b2db4c41d1164c6433d5e_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Cecil
H9922
Law
Quip
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE