H9922
King
Mild
Behavioral task
behavioral1
Sample
3de5fbdfd65c7fe02e1f98f50d41cee4_JaffaCakes118.dll
Resource
win7-20240903-en
Target
3de5fbdfd65c7fe02e1f98f50d41cee4_JaffaCakes118
Size
154KB
MD5
3de5fbdfd65c7fe02e1f98f50d41cee4
SHA1
e0bb0d075b89c72c03f0195793e70d6a0615d2a5
SHA256
50308217e1829877c362bbb366aefd187db41afba32cfdf427da16d94cc8210e
SHA512
601187070246b876c794a935fccc714de7e9830560752879680588c062edcd2a131101162999549c992d2d91586218fc6c896f52dd2817167007244fed9375d6
SSDEEP
3072:ZVt13VaY7aksoW+1fkEWInqnVv/CjCYxBQ6rbZIGpVi837Ydoou1vg1:TPUKaksbMfFWIsnChQKbZOyIooW
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
3de5fbdfd65c7fe02e1f98f50d41cee4_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
H9922
King
Mild
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE