CheckTry
CloseExFile
ConfigMe
ExtractFile
ExtractMem
GetDescribe
GetFileList
InitPlugin
LoadConfig
PackFiles
SaveConfig
SaveExFile
StopExFile
Static task
static1
Behavioral task
behavioral1
Sample
a7e119d0d078ea2847abd0f2d0dc1498_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
a7e119d0d078ea2847abd0f2d0dc1498_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
a7e119d0d078ea2847abd0f2d0dc1498_JaffaCakes118
Size
160KB
MD5
a7e119d0d078ea2847abd0f2d0dc1498
SHA1
6fdcacc6062ecba79dc2d1dfd670bc6a0a1d612c
SHA256
2e43db9bd492abb5512cd694cd39565884dc3a3560edb876b5bae709c8884b6d
SHA512
20f825e53340ab82c08ecda48e2a5f13c4a50e3afeabcd975473db299844dc2179950cbf779baf5142cf983590c1cc653e853be40f0d94f56f1d010601600a5a
SSDEEP
3072:kKfmQPhIK1mPBnOS7BQFrtUGM121aaZPwY9VB3Rjay4RbuSfOuxFLEg9llJM9lS:dfmQKK12BnaUGMg15uOVBobRxFLH/leO
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
Checks for missing Authenticode signature.
resource |
---|
a7e119d0d078ea2847abd0f2d0dc1498_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
CheckTry
CloseExFile
ConfigMe
ExtractFile
ExtractMem
GetDescribe
GetFileList
InitPlugin
LoadConfig
PackFiles
SaveConfig
SaveExFile
StopExFile
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE