nomxd
offmxd
Static task
static1
Behavioral task
behavioral1
Sample
b4f663e9fdd2d2a9989ab19c9b332ebf_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b4f663e9fdd2d2a9989ab19c9b332ebf_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
b4f663e9fdd2d2a9989ab19c9b332ebf_JaffaCakes118
Size
229KB
MD5
b4f663e9fdd2d2a9989ab19c9b332ebf
SHA1
e9729f18d080bdd2b9bac4f4b8084fb473e37561
SHA256
51204f9309e3524f1049337614f0e9359d4459c84d2640a7d0de6e2c5c7d500c
SHA512
d9409d91bb88f3dbb1701946bc59097d6aaff55f81e25c6a805c81384efeb71eea3a7ed499e064bd9e1fe0c219d811e9ba2bc017816be54c3efc0ce3c5fa7cc7
SSDEEP
6144:n3khk5VX5/bMe67fGX7HhHbzIBWpmWhOf8pPfq2J+7:0i5VXe7uDhfIBW8Gnc
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
Checks for missing Authenticode signature.
resource |
---|
b4f663e9fdd2d2a9989ab19c9b332ebf_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetProcAddress
GetModuleHandleA
LoadLibraryA
ExitProcess
MessageBoxA
nomxd
offmxd
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE