COMResModuleInstance
JUFndB4pARSJ
QSTdR8vtujTSKh
X5pVSzSF
dP5yRxpb
Behavioral task
behavioral1
Sample
d6eb541107259b80a443c35f397483a0_JaffaCakes118.dll
Resource
win7-20240903-en
Target
d6eb541107259b80a443c35f397483a0_JaffaCakes118
Size
17KB
MD5
d6eb541107259b80a443c35f397483a0
SHA1
4a9ffaafe18d4662570c14f152b25d2bc5709973
SHA256
eed3ae4ee55998ab0ce33b77cfb57b248a12637591f7402c42e4133d274f936c
SHA512
8b38ac50337cb5c7c200bddb2e6e31d1bc79e36d83f15e2214c7f98a00aa441e7c9b71a4bf4362bd226cdf09736804c1705b5566023c4bac05c16a6fb043e61b
SSDEEP
384:h4/PdPpxS8wzE5UjNRaZR9IRJY4n4pZv69k952Tr60dw0U:h67S/guNy9IRJLn4vp952Tm8wx
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
d6eb541107259b80a443c35f397483a0_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
COMResModuleInstance
JUFndB4pARSJ
QSTdR8vtujTSKh
X5pVSzSF
dP5yRxpb
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ