ClearAV
DoWork
Behavioral task
behavioral1
Sample
be0c0f0f61e266bdecd1f174f00972df_JaffaCakes118.dll
Resource
win7-20240704-en
Target
be0c0f0f61e266bdecd1f174f00972df_JaffaCakes118
Size
20KB
MD5
be0c0f0f61e266bdecd1f174f00972df
SHA1
ef330fcf0b45eb9eaabd12d6cfdd0cf19959692e
SHA256
e9a4e68778153195fea5273966dbc29e022dc02d3ea63d07318be62d7362b83e
SHA512
70190772bf3018ed665fec698c7dea01aa2bcb3443dc1162b18ae9d2b04cdcae810b38ca1e2c0b8bdd2997ff44565d92741dcd163683c4de029d025fa4c87d4a
SSDEEP
384:9Ush4eccgD4pvcJ102AG8s98Yg9K9narVKKtNV255Icp3ubJ:9US4eccgDLTF98fK9nucNp3uV
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
be0c0f0f61e266bdecd1f174f00972df_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
ClearAV
DoWork
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ