RunAs
SensNotifyNetconEvent
SensNotifyRasEvent
SensNotifyWinlogonEvent
ServiceMain
StartAs
Target
b59053d4dc6cd729d40a84fb06ade49d_JaffaCakes118
Size
208KB
MD5
b59053d4dc6cd729d40a84fb06ade49d
SHA1
6e8b0088f0bf5de4b2365032c849f41e4e7e9600
SHA256
cfa31e32a3831bdce0b61daf94ec6d38b002a646fb1396e028f8f1cb38a535f0
SHA512
a2c0cffc07bc9a4047608f595b58334052dd34201ca8df01b16b677da0d89125a2fa18cfa978878e6c9ab4a676942dad9e57f986e08b724d655553381230af4f
SSDEEP
6144:Z6Ye2tnoL+hq7KfRFPnz1ZeAzjAr+k6/3bP2cgCNoSH:UYf9fn/z1PPOU6teoSH
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
b59053d4dc6cd729d40a84fb06ade49d_JaffaCakes118 |
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
RunAs
SensNotifyNetconEvent
SensNotifyRasEvent
SensNotifyWinlogonEvent
ServiceMain
StartAs
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE