AddMsg
CloseFileMapping
CloseFileMapping_readonly
GetRegDword
GetRegString
LoadFileMapping
Reg_Delete_Value
SearchAndReplace
SetRegDword
SetRegString
write_disk_file
Behavioral task
behavioral1
Sample
b1856ae135d368a7610278cb6bf0dc92_JaffaCakes118.exe
Resource
win7-20240704-en
Target
b1856ae135d368a7610278cb6bf0dc92_JaffaCakes118
Size
465KB
MD5
b1856ae135d368a7610278cb6bf0dc92
SHA1
caccf53e91ef5d89917f5255c2784d72aaf10be5
SHA256
95f1f73acaf08795a6ca3fb750eae47414a92c0b1f610085bb18ff5775b0a716
SHA512
a0be2cbd4840cb958e88c7b2229bd3801e95e41a8ac77b8a4d316e79186a0df6f3395ff150b7868059fcb7070773c22be0f30a4f16a8d2bc8520bf948ab00d07
SSDEEP
6144:vUW1Xz/OAT9CwYboEns9zszwiP3QP0B9UlY3fJ0PkAcUU8SuRN:pF/TCRblmszwi4P7mfJfy
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
b1856ae135d368a7610278cb6bf0dc92_JaffaCakes118 |
unpack001/out.upx |
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
AddMsg
CloseFileMapping
CloseFileMapping_readonly
GetRegDword
GetRegString
LoadFileMapping
Reg_Delete_Value
SearchAndReplace
SetRegDword
SetRegString
write_disk_file
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ