PlgDestroy
PlgGetAbout
PlgGetDirectLink
PlgInit
Behavioral task
behavioral1
Sample
fb471757d446cc03362b8f6184d16909_JaffaCakes118.dll
Resource
win7-20240903-en
Target
fb471757d446cc03362b8f6184d16909_JaffaCakes118
Size
33KB
MD5
fb471757d446cc03362b8f6184d16909
SHA1
76c0dc34e90b08c31c2dd28253d5b2143880ac11
SHA256
d0b56cd3403b07bd23d9792a9de291feea560850c0504214725e3e8b5aeb7c31
SHA512
f96d11846b15610cf46148a4f53e84ab65c29ee688ba195a3d4340d67073ccb5c0c7016686bdd2a62a7c8d39bc376231a780d025ace6f5daf5dc7a155db126ae
SSDEEP
768:wXkL8Di9gmaqadpLoOSK8dvGyHuAdz+OHwC6j0m9ID:wUL7GjduOSK8RHuOxHOj0mKD
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
fb471757d446cc03362b8f6184d16909_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PlgDestroy
PlgGetAbout
PlgGetDirectLink
PlgInit
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ