mod_start
mod_stop
Behavioral task
behavioral1
Sample
2d934f0007d7d31501cc81a68743a810_JaffaCakes118.dll
Resource
win7-20240708-en
Target
2d934f0007d7d31501cc81a68743a810_JaffaCakes118
Size
48KB
MD5
2d934f0007d7d31501cc81a68743a810
SHA1
8d7d37044699020241f6b0dbba89d795cbf9cb1f
SHA256
e04cb79e9a79524ebe5f059d580d9e737df7c433e649511c99c174de2f3a219e
SHA512
532c978a8aaed9c70868387de4ddeb5cf157aff7602c5f2629f072a7b8aca8c2de5472a58ebbfac670bb4735ba509842e70cbef9889a7cf9d0abd2cd2100f9b9
SSDEEP
768:UN4Zh4p/ngtX/v/MlQc8UX8yF+L/jmP+LPsjRBu7F7OJeddrQhBdEl:xZONng5/WQwX8/idRBuld1QlEl
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
2d934f0007d7d31501cc81a68743a810_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
mod_start
mod_stop
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ