KSelp
SetSvText
SrvStat
SvcEntry_Seclogon
writedllpath
Behavioral task
behavioral1
Sample
d2fea606b125e23f5376a6a8e0926c1a_JaffaCakes118.dll
Resource
win7-20240903-en
Target
d2fea606b125e23f5376a6a8e0926c1a_JaffaCakes118
Size
250KB
MD5
d2fea606b125e23f5376a6a8e0926c1a
SHA1
8326aae6c0ef5b269bde5e42ad3e55ca722fe5b3
SHA256
d2f86ecb9bbdc0c71cf3205b63adc5376cab909b327ed617a03d6744a003f27e
SHA512
84a2552f62ce43195a5570be6808c0cd59b4aabc061a4acf32e7547afe7f93237bfa8f5a55d02357e9347154768c360cf996b8eea04765069a6c23d94134bf55
SSDEEP
6144:+FXaF7LjNfzAvIkRL7/VBNzQ7CxbHli7JA4S:2XaZNfsvIyVzQG9Hg7JA4S
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
d2fea606b125e23f5376a6a8e0926c1a_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
KSelp
SetSvText
SrvStat
SvcEntry_Seclogon
writedllpath
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE