InstallU
PluginCommand
PluginMain
PluginName
PluginType
PluginVersion
WSPStartup
Behavioral task
behavioral1
Sample
bfe953190a11ad58f702435dc22f8601_JaffaCakes118.dll
Resource
win7-20240705-en
Target
bfe953190a11ad58f702435dc22f8601_JaffaCakes118
Size
98KB
MD5
bfe953190a11ad58f702435dc22f8601
SHA1
2c08d75a4eb0db816289fe98977f43cc231795de
SHA256
d2ed26e0f51ec1ffb83fce0564d0ed11d7cf246050ec9252c43473b4721e0200
SHA512
9c096266f097b913a82b8d0b5d11b0814ac5962cd56bb16faaeebb163a7cc3d07260ed6b87e0f2704e193225d8822b9e93f5b77db4901592bfa88e77a5662e16
SSDEEP
3072:woTywKVnuASLEX2j2ZcDJ33YG891rILGi:wXGjGcDtp89BIL
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
bfe953190a11ad58f702435dc22f8601_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
InstallU
PluginCommand
PluginMain
PluginName
PluginType
PluginVersion
WSPStartup
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ