PlgDestroy
PlgGetAbout
PlgGetDirectLink
PlgInit
Behavioral task
behavioral1
Sample
d9f5d5353b2b3902e4e039ffc23ff00b_JaffaCakes118.dll
Resource
win7-20240903-en
Target
d9f5d5353b2b3902e4e039ffc23ff00b_JaffaCakes118
Size
30KB
MD5
d9f5d5353b2b3902e4e039ffc23ff00b
SHA1
dbc31cebd48a35d32bd55fffb92287282ec8f845
SHA256
c055fc74c8879bc7f391b8913413de842f1e69b22a699cd6c612d176daf991d2
SHA512
a5e2d01c281756af03d1a46c7e5750969c6c0794625b1fa5f327ce8b6afa5c78064dc464742ab0918e240361286445e069816372ab4ca4d5d487564a3146c3ef
SSDEEP
768:P3ztIgoZ0EUtf7wZI5svNhgyFpV1csw3zVft:P3aBZUtfB5krbNw3Zf
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
d9f5d5353b2b3902e4e039ffc23ff00b_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PlgDestroy
PlgGetAbout
PlgGetDirectLink
PlgInit
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ