KSelp
SetSvText
SrvStat
SvcEntry_Seclogon
writedllpath
Behavioral task
behavioral1
Sample
a4d014d08f93117132c602ac53db39fe_JaffaCakes118.dll
Resource
win7-20240708-en
Target
a4d014d08f93117132c602ac53db39fe_JaffaCakes118
Size
249KB
MD5
a4d014d08f93117132c602ac53db39fe
SHA1
9dda4919db12ba25689cb5080650e25798168351
SHA256
92383b1846cc3672255baf84d4d1ce914d975ad974a73c8ce0c0fd6f969911e5
SHA512
cc4259005574dd196e6b1de823c90c8bafb34163209c7d0f7ef662c2fde3e2ce13d6423cce8334022178a289f35a16b44f8e17f2c9d84c774c0bafc2bde5f1a9
SSDEEP
6144:UFXaF7LjNfzAvIkRL7/VBNzQ7CxbHli7JA4/:QXaZNfsvIyVzQG9Hg7JA4/
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
a4d014d08f93117132c602ac53db39fe_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
KSelp
SetSvText
SrvStat
SvcEntry_Seclogon
writedllpath
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE