_LOADLIBRARY_DUMMY
_RunAs@16
Behavioral task
behavioral1
Sample
cf3d3254a75f1aa3e0431398a9d1c808_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cf3d3254a75f1aa3e0431398a9d1c808_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
cf3d3254a75f1aa3e0431398a9d1c808_JaffaCakes118
Size
37KB
MD5
cf3d3254a75f1aa3e0431398a9d1c808
SHA1
b89a0a88b6f791882ee25cc2d2c04d164d85b198
SHA256
f8c43650e6df8510a39edc575f4bc9f767a686e54a9d5be5b80f466b428c6f0e
SHA512
c0127ed67d018576b3bd8d2d4d20a5c5600b243b82052e80470f4e44ecd57db8e80642d7deac1206b86f5879028dc20098a71f1935e1a95b6dec68f40a81629c
SSDEEP
768:wz1zuXHrQsX8xx7c4dpyzfkfAmPXN8L+WluGnv4anbcuyD7UaN:waHrQsKJnyz+dVGnQanouy8k
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
cf3d3254a75f1aa3e0431398a9d1c808_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
_LOADLIBRARY_DUMMY
_RunAs@16
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE