PlgDestroy
PlgGetDirectLink
PlgInit
Behavioral task
behavioral1
Sample
0c81d9f59736143279ab485dd49ba29e_JaffaCakes118.dll
Resource
win7-20240704-en
Target
0c81d9f59736143279ab485dd49ba29e_JaffaCakes118
Size
30KB
MD5
0c81d9f59736143279ab485dd49ba29e
SHA1
f60ed1a4fe3084e4b25aa72851973f7ca39baea0
SHA256
704f523bab653f42a35f17c19dbf922c298fd6c5511b98f1dc97c06d9597e4d5
SHA512
61f1b70a8ad07e4eefd4f800e8232823dc16a351949ef74cd40f081a3aed5952064ffc17d05365cce0055642897146d875e201258a11724462f532798c53861e
SSDEEP
384:ZGOGYcw30Km0baDN91H+KBAJKSSP+2OKvS5F0uDiq6miacBAFY0YHfhkmU17zXnm:Lh9m7YSS0+OU0uwmQAKlemUlz329
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
0c81d9f59736143279ab485dd49ba29e_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PlgDestroy
PlgGetDirectLink
PlgInit
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ