_LOADLIBRARY_DUMMY
_RunAs@16
Behavioral task
behavioral1
Sample
e9df66c7c670ca5c8807aa4ec4cdcce1_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e9df66c7c670ca5c8807aa4ec4cdcce1_JaffaCakes118.dll
Resource
win10v2004-20240910-en
Target
e9df66c7c670ca5c8807aa4ec4cdcce1_JaffaCakes118
Size
34KB
MD5
e9df66c7c670ca5c8807aa4ec4cdcce1
SHA1
0d721dc7b576916f91fc4e643ad0b267bc56a951
SHA256
7c1316466303a7fc620ad159b56f193dfd09b2f8c334b4939e777404807aac49
SHA512
78f97d168e2db16abbcb5854dfb467e1d7e67e18e34a76a315c9053104fdad0c2e156a596561f0d9d03cb0f2eca4b89b03f96a89e3d40d51ca7af17dbd432197
SSDEEP
768:GsfV5PRqRw82E8jtyWlLDLwFVE4GEIIlmfM1wzsSnbcuyD7UMBa:GzJWlLwFVE4HOMxSnouy8MBa
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
e9df66c7c670ca5c8807aa4ec4cdcce1_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
_LOADLIBRARY_DUMMY
_RunAs@16
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE