F1
F2
F3
Behavioral task
behavioral1
Sample
ef6d891e3a882a19c0c8276b5d968008_JaffaCakes118.dll
Resource
win7-20240708-en
Target
ef6d891e3a882a19c0c8276b5d968008_JaffaCakes118
Size
18KB
MD5
ef6d891e3a882a19c0c8276b5d968008
SHA1
9f340314fbcf833a038bf30a49e94cf0e987953f
SHA256
8b3abc68c6b12770d62b9b7ad9d7e7ec969f294e934bc0c5454de32c5d866700
SHA512
c674f2653c1a75692fbd027e27eab0886bb00e15daa7c624f4ba1abddcdfa797e1ecec15bdb194a8f36446fda705c461762d5b36545ac27a12250a805cecfcba
SSDEEP
384:B57/SOr2Dp/ye3B91Xqdx00R954bQLSBS9SPczWeABUkU2SY30ooHA:BJN2DpXB94vOkABA20oo
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
ef6d891e3a882a19c0c8276b5d968008_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
F1
F2
F3
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ