allert
load
windows
Behavioral task
behavioral1
Sample
37343deb6d45557ec5f271b4aa999b95_JaffaCakes118.dll
Resource
win7-20240903-en
Target
37343deb6d45557ec5f271b4aa999b95_JaffaCakes118
Size
8KB
MD5
37343deb6d45557ec5f271b4aa999b95
SHA1
15a11f321b879218009b4e7e23f30df7809f7d6b
SHA256
e44a00703e307ba335323e596a1aa26c1fa04ca6877beb686eb7e870f8594127
SHA512
b6464e168426b4897fa09b9665384034b698a3daaeb96e27402b751b9b3a5aa9b8a65bbc692cbc4f40e6efa7d9adb6da62faea23af5bcaec0ffdb5631bb41abb
SSDEEP
192:QB38+aVeyENPAh4mNcbdUjlnVrqbbKxe+ujzlY4TM:S38iy6oemibdUpVrqbbn+ujzll
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
37343deb6d45557ec5f271b4aa999b95_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
allert
load
windows
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ