GetNewInf
GetNewSock
Behavioral task
behavioral1
Sample
8c25ed2050d9147112bd944e7ea3cf19_JaffaCakes118.dll
Resource
win7-20240729-en
Target
8c25ed2050d9147112bd944e7ea3cf19_JaffaCakes118
Size
413KB
MD5
8c25ed2050d9147112bd944e7ea3cf19
SHA1
050fcf7c1cc1fc76f8c8cbb0b5081ae812f7560a
SHA256
9366325139cb6432447c83c3be6b7401c1fbd7f5cca9383eac875710fdb619f2
SHA512
f758487124a8f5859eec9a8c396fc0cfe087116a3dc4251b2e1f6eb50876a338bd49119957cd38f737351613c6d9397190eac1623e3e44607522d4ef29f108bc
SSDEEP
6144:Fg2chS81MujjfGKJcXrIPOjlwYUX9141Vofw1rwfklGvVlr87g:FRC1DLKXrP6r106f/V/
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
8c25ed2050d9147112bd944e7ea3cf19_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetNewInf
GetNewSock
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ