DeinstallProvider
InstallProvider
WSPStartup
___CPPdebugHook
Behavioral task
behavioral1
Sample
e1c1f5d0b5f0fee73c9d48aad08d8e70_JaffaCakes118.dll
Resource
win7-20240903-en
Target
e1c1f5d0b5f0fee73c9d48aad08d8e70_JaffaCakes118
Size
75KB
MD5
e1c1f5d0b5f0fee73c9d48aad08d8e70
SHA1
253b4af7e50564b38c4768a47b761aead05dea16
SHA256
dcccd5c79263a0bec313ffb2f4375276005d0710af912816da924917db835c30
SHA512
7a9fdf0de75dfbf25719daa63704025c8c52aaa681a3b6288553359c5a2ccf82de17a42a69117af5935f8e501c8fc091d2f07f07b614d5c296a55b2e8411971e
SSDEEP
1536:scuef8z+3DI4F/i9eaWXZ5UN8vHNEP9rF08W6z0:M032XcU2HNgGb6Y
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
e1c1f5d0b5f0fee73c9d48aad08d8e70_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
DeinstallProvider
InstallProvider
WSPStartup
___CPPdebugHook
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ