DoWork
Install
RunOnce
Uninstall
WSPStartup
Behavioral task
behavioral1
Sample
fe9f01f408e284f5a203b9f39a9852f5_JaffaCakes118.dll
Resource
win7-20240903-en
Target
fe9f01f408e284f5a203b9f39a9852f5_JaffaCakes118
Size
107KB
MD5
fe9f01f408e284f5a203b9f39a9852f5
SHA1
2c1fbf82c4c0794d080737840a916f9d1222d166
SHA256
d062b9c3bee3fa0dabcc22f52b2634eb0f4d6c441db0395140d3f8d0ac3f3940
SHA512
67a0768b78796aaad10babd16cd29a5ecd9f4bfdbf521139ad2325b494d67845d32beb63bf97779ec843696d31ba9f427d426207972876fa3cb8ef89f4494800
SSDEEP
3072:zmXIXonj0pN6l94DEIxrj3WR8rBscH+Eyp3Pf:zmEME6l94DEIlbWWV/eEg3P
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
fe9f01f408e284f5a203b9f39a9852f5_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DoWork
Install
RunOnce
Uninstall
WSPStartup
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ