SchedServiceMain
ServiceMain
SvchostEntry_W32Time
Behavioral task
behavioral1
Sample
a819b252e8f83e1ca5f5acdfc7346a5a_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a819b252e8f83e1ca5f5acdfc7346a5a_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
a819b252e8f83e1ca5f5acdfc7346a5a_JaffaCakes118
Size
143KB
MD5
a819b252e8f83e1ca5f5acdfc7346a5a
SHA1
b1f844b1243fc6b368e8cba112508f6a74b2e0db
SHA256
b2e9481368af7621bacabc80fbdf053c4c3ad34ac7df6ad7d53cc88f7c818100
SHA512
411bc62a8520e9d49991c6e6ddd965ff06983f988a4496f88041cfec45d1e6d64be5e800fb18903393e723d125d6ae37f862a063c19843a2e9e601a721cd27bc
SSDEEP
1536:PxDEPJDogco8bph+AHTUiCgzw3BWtvbC2XGrR56pFm78k66EC4VnMkbO+sc8bCXp:kDr43+lidG22igpHg2c8uXsAV
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
a819b252e8f83e1ca5f5acdfc7346a5a_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
SchedServiceMain
ServiceMain
SvchostEntry_W32Time
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ