_LOADLIBRARY_DUMMY
_RunAs@16
Behavioral task
behavioral1
Sample
fe6ccc7d9c3e392aabe2d5e47dea2be5_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fe6ccc7d9c3e392aabe2d5e47dea2be5_JaffaCakes118.dll
Resource
win10v2004-20240910-en
Target
fe6ccc7d9c3e392aabe2d5e47dea2be5_JaffaCakes118
Size
35KB
MD5
fe6ccc7d9c3e392aabe2d5e47dea2be5
SHA1
8ef24b0a002223179cda484ca92f184fdb326833
SHA256
2e93f9b45b227c301c168aa664b2b3f0b4c219c6fe4f93e145be6a3e77f87573
SHA512
7cd8fc62dd584259a8b16c90587a614ba99025a3d0651c250a694321c970c453295ff3c87b911e613b1a39fc4d0aaa2eb677e18d2ac0a16d5cee5e177835fb07
SSDEEP
768:1gpl78b0onCNKHt9imfPrUoC7jJeZGj54n2Hf/kFG9:1Al78jCNKN0mn9qQGj542Hf8FG9
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
fe6ccc7d9c3e392aabe2d5e47dea2be5_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
_LOADLIBRARY_DUMMY
_RunAs@16
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ