indx
prstart2
tpLi2005
tpbl
Behavioral task
behavioral1
Sample
57087ce8815a0d53facccee33fd388be_JaffaCakes118.dll
Resource
win7-20240903-en
Target
57087ce8815a0d53facccee33fd388be_JaffaCakes118
Size
199KB
MD5
57087ce8815a0d53facccee33fd388be
SHA1
88e8bfbee7849f0266b5c6753074288cfc07a114
SHA256
e7e9f86939634814e53202b8167fbe59f70243fb64d479a10fd246ce5a445a31
SHA512
3b0f14526ecc6dd982853b98fb9506272dd820382aa75d40212b8d162ae1c5a1d3e2ae1bf9a2ec33731a3a14cb37183241064582924ef63287196bc7d2fd1510
SSDEEP
6144:ETmip9tpa8um8biE7En82e+1KgzoZkHzEdm9Pnb:ETtp9truV8XcgEeEdmd
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
57087ce8815a0d53facccee33fd388be_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
indx
prstart2
tpLi2005
tpbl
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE