Connect
Disconnect
RecvData
Version
Behavioral task
behavioral1
Sample
11aa54103e7311ad23b4e60292dc9e82_JaffaCakes118.dll
Resource
win7-20240903-en
Target
11aa54103e7311ad23b4e60292dc9e82_JaffaCakes118
Size
10KB
MD5
11aa54103e7311ad23b4e60292dc9e82
SHA1
59e7f0aaa8305ad0c5c830c16b531d1e2ab641b4
SHA256
afbe298d9bf915b55c3733aa84008c92a277c2bde5d4d1dd18d8f8bc208fed13
SHA512
ef3dfda64c2dbeab841948b9f52f784ff1e9134a64e963bd872fba498d4c8acd87c948cda063c7be07992023b87ebca4632db0d32e508dbe4b8f6ca211e89e7b
SSDEEP
192:n4vqijC1qdmmHYjAqRyROTVGro1f0rSF04/oPEaxJ1T3:sbjwqNHEAqRRb1cifxa5
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
11aa54103e7311ad23b4e60292dc9e82_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Connect
Disconnect
RecvData
Version
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ