?GetOS@Utility@@SAKXZ
_LOADLIBRARY_DUMMY
Behavioral task
behavioral1
Sample
a4b8953cc3b35197f5ad7660022084b5_JaffaCakes118.dll
Resource
win7-20240708-en
Target
a4b8953cc3b35197f5ad7660022084b5_JaffaCakes118
Size
28KB
MD5
a4b8953cc3b35197f5ad7660022084b5
SHA1
d07ea1dc17fe9aea1dfb2ae7ce5098ad1746e9ea
SHA256
7fdadc80de8b2f78c163cf4af3464e850ec88f5da4954477cd96596c99f0dca0
SHA512
170c1485aedb44496c18bbdad799158cb8295a344dce8a508bc78695c881f6149179a5e0ddab75325f0dcea6f35cad0654a381271dfe6ad3c9c1f85359496068
SSDEEP
768:k78O9btX4LNovESQ9rviFzv3xVssDBHe1eEMfU:kwOwLNoMSQ97i5hVseHekhU
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
a4b8953cc3b35197f5ad7660022084b5_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
?GetOS@Utility@@SAKXZ
_LOADLIBRARY_DUMMY
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ