??4CGS1@@QAEAAV0@ABV0@@Z
WSPStartup
Behavioral task
behavioral1
Sample
04a45798dec7c5de39439ede317de03d_JaffaCakes118.dll
Resource
win7-20240708-en
Target
04a45798dec7c5de39439ede317de03d_JaffaCakes118
Size
262KB
MD5
04a45798dec7c5de39439ede317de03d
SHA1
429c2751be6fd00880d721e325d823ddd2ddcaf8
SHA256
b2186f0aa76dd4d52733f9084d1b33a90d7f02c58e5f37d7ba7abbd8a6a332c4
SHA512
67c94d87eac93ab8a6806893e81fb4652d7afb3e84db7af270aa423be7df91282687bb1cca897f37f6ced37da2e10b0014c174dc9bbcd165c338ce2ee3173777
SSDEEP
6144:gZNVdhxth2yS3D6rCCGo5OI83cTUPNz/5dMg5PT/zs+du:gDhPuD6rCCG2O3RNz/V5PTbXU
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
04a45798dec7c5de39439ede317de03d_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
??4CGS1@@QAEAAV0@ABV0@@Z
WSPStartup
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ