CheckSave
CheckStack
OpenSave
ShellPath
s
Behavioral task
behavioral1
Sample
cf222627744cec0cd3d5108d21060878_JaffaCakes118.dll
Resource
win7-20240903-en
Target
cf222627744cec0cd3d5108d21060878_JaffaCakes118
Size
44KB
MD5
cf222627744cec0cd3d5108d21060878
SHA1
8b95a0c7e91559d9e2f6cac68eeb039fe48e9773
SHA256
e4524273bdcc92d2068425ae58277abccb05c5838f404fac700793d1599c8726
SHA512
7f7912e127583da2163b1fe24aaab3acf5d49ce4ca0b27532b6b2999d64ec48df916f0c84424be0d5c57518d3bf4212ef40768ff791a383d79fc00acf843e8ce
SSDEEP
768:yvrszB9Qy2EJP8mt2c41GV50K6jTOPN/p+2zuYGd3cLoVnKeNwrXr:yv46yLJP8k2/1GVKS+2yYGVptNwr
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
cf222627744cec0cd3d5108d21060878_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CheckSave
CheckStack
OpenSave
ShellPath
s
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ