DZLL
VMP����������־
VMP������ʼ��־
_xiaoze
����CALL
����CALL
��������
������ֵ
������ֵ
���Ӷ��ѹ�ͼ
����ר��
Static task
static1
Behavioral task
behavioral1
Sample
3df993cf9fa6a47ec4333e7a6bc585c7_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3df993cf9fa6a47ec4333e7a6bc585c7_JaffaCakes118.dll
Resource
win10v2004-20241007-en
Target
3df993cf9fa6a47ec4333e7a6bc585c7_JaffaCakes118
Size
815KB
MD5
3df993cf9fa6a47ec4333e7a6bc585c7
SHA1
e9d60f5f1cc2a258f890a58ca24975da239becc9
SHA256
4ce9fb857425828294d7e229463767379c2757517bdcb70e61058d9ff2444616
SHA512
33d6e9d7760bb05d9172ee4534a72534ddbe98a37708b73c3479dfa1220de1e44f80f19630022a3d9f64fae7a1b9d37b7b25ae164d5417d4bc62611bbd96aa8a
SSDEEP
12288:huKi8Z220anr1EFzD97vr7b6BfJ0FXap3cY0:huKiq23mE7vXmBSFcsY0
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
Checks for missing Authenticode signature.
resource |
---|
3df993cf9fa6a47ec4333e7a6bc585c7_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DZLL
VMP����������־
VMP������ʼ��־
_xiaoze
����CALL
����CALL
��������
������ֵ
������ֵ
���Ӷ��ѹ�ͼ
����ר��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE