RunAs
SensNotifyNetconEvent
SensNotifyRasEvent
SensNotifyWinlogonEvent
ServiceMain
StartAs
Behavioral task
behavioral1
Sample
03fe48e5eec8a885aa51bdfe15f9dbdd_JaffaCakes118.dll
Resource
win7-20240903-en
Target
03fe48e5eec8a885aa51bdfe15f9dbdd_JaffaCakes118
Size
3.0MB
MD5
03fe48e5eec8a885aa51bdfe15f9dbdd
SHA1
5c0b53201aa1b99e962a359fd93733fdbb9cb74b
SHA256
10be8d69a5c38bc7c541009aa561590de6d0751db3a08a799b954d9c526bc39a
SHA512
b2b2dad566bfeae305cc7395547531734c772d988ef7708209f15f4bd912458b4c93d7b7429e7de61f12e4180ed7346828f6480af46e4b9c9a9d1b25b3a44fd8
SSDEEP
6144:6sC24pQpSBUV+FVRXoe8X+oXEQ/M8sToS:6m4mSBUgRX9S+oUQ/MHToS
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
03fe48e5eec8a885aa51bdfe15f9dbdd_JaffaCakes118 |
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
RunAs
SensNotifyNetconEvent
SensNotifyRasEvent
SensNotifyWinlogonEvent
ServiceMain
StartAs
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE