RundllInstallA
ServiceMain
Behavioral task
behavioral1
Sample
055d2bf5f359375e3dc6ed89cdcc2dc7_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
055d2bf5f359375e3dc6ed89cdcc2dc7_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
055d2bf5f359375e3dc6ed89cdcc2dc7_JaffaCakes118
Size
114KB
MD5
055d2bf5f359375e3dc6ed89cdcc2dc7
SHA1
266835445daa98489ec59cefe002ae78b97e6f08
SHA256
cdf603a2dbde234aa5fab5a5f565447de3f4e3d962b136629005ad70cbaaa274
SHA512
c80810b230017a88b6469078ff864e5fa3289b57b4ccc97d6d46d48f8eb7a28bb2c8f11af3772464037d55d27cb791655816e5432d6c091b5678641ca3a3ddfe
SSDEEP
3072:W6KnCysyEK/ZMDXspGQvQYt1KaKAM7MFGsWs9Q:W6wC2hycpGON1KaJNFGs
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
055d2bf5f359375e3dc6ed89cdcc2dc7_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
RundllInstallA
ServiceMain
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ