plugin_reg_handoff
plugin_register
version
Behavioral task
behavioral1
Sample
e1e3eafb6bb503437637664915226fa6_JaffaCakes118.dll
Resource
win7-20240903-en
Target
e1e3eafb6bb503437637664915226fa6_JaffaCakes118
Size
5KB
MD5
e1e3eafb6bb503437637664915226fa6
SHA1
b7bcec205c0223f7bb05351e80a79f40a5f0241a
SHA256
415d1e94a558014e10fa760dada052a11aa9b08ccce4042010b4cab4797c4a0b
SHA512
0990261a5b03ed53fff2aaa31d585a45fb767f766696c8b3a663fe3ebc995043ba7ea4156e57ae4883299789bc6311f69ff7864e35fb716112adf2e2151c9d55
SSDEEP
96:v/eHZbJxb4SbfiuaOWdW/kbDpSHenE11sKS/2Vv:v/+NJGgfSYcWKE1KKs4
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
e1e3eafb6bb503437637664915226fa6_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
plugin_reg_handoff
plugin_register
version
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ