no123mxd
off123mxd
Static task
static1
Behavioral task
behavioral1
Sample
d2ace9af82b740b6b338e2bad050b9d4_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
d2ace9af82b740b6b338e2bad050b9d4_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
d2ace9af82b740b6b338e2bad050b9d4_JaffaCakes118
Size
229KB
MD5
d2ace9af82b740b6b338e2bad050b9d4
SHA1
5eed8a257aa223c1c2e4c93b51830f06a75123ab
SHA256
708308bdef03667c358dc634175c781fb998abd44bb65a55ca36b074c2dcab9e
SHA512
e886413c2dcacd1a88850a8da5891b243bec1515ba84ab892350f6c4670d796dc5358aa76486937d8b485431fe9f8db6a982c19c327c4449d15547f5cdf8608d
SSDEEP
3072:R0mNz1vNPwdXt3i3emXuteoT7+C/Fsm5xaaF+CbU0IG4K5KKWcWHfDuV6r3V7RyB:2EzfPutCGBT7pfv+QKvcAlxsLVX
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
Checks for missing Authenticode signature.
resource |
---|
d2ace9af82b740b6b338e2bad050b9d4_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetProcAddress
GetModuleHandleA
LoadLibraryA
ExitProcess
MessageBoxA
no123mxd
off123mxd
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE