load
update_load
Behavioral task
behavioral1
Sample
8a790eda173bcfda2a1cb71f61872cf6_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8a790eda173bcfda2a1cb71f61872cf6_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
8a790eda173bcfda2a1cb71f61872cf6_JaffaCakes118
Size
88KB
MD5
8a790eda173bcfda2a1cb71f61872cf6
SHA1
8a015f828bfed38d23911c588b3666846ab4b522
SHA256
6f2c6edea2991b53dc7e82d8e2504fecba1683f644742b0e880bedd0a4980b05
SHA512
51e3788bf29fb712011263896fccc4386a76041ed97c3cc4857506919da83f6a4c14f42ee8f8c7add4d2c1198b50bc23b62059788ebe41989511da1de61f91b8
SSDEEP
1536:rbA1MnHYlSeKmbbfG63LBrhX4RT/O01FNMjXnfhJt1eAvIh:rUeYlSeKCu63Lr4RT20fNMJyAA
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
8a790eda173bcfda2a1cb71f61872cf6_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
load
update_load
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ