Gloss
Hind
SuppS
Behavioral task
behavioral1
Sample
cd98c33b8c684c19e1571187a8ff3234_JaffaCakes118.dll
Resource
win7-20241010-en
Target
cd98c33b8c684c19e1571187a8ff3234_JaffaCakes118
Size
188KB
MD5
cd98c33b8c684c19e1571187a8ff3234
SHA1
35714eaeb855124cfbf9607132db4d2bcbde3288
SHA256
43d7182f818869d94e4bd1e16bd157f1981aa9002bdc689ce2736b29354ec178
SHA512
4079f15f6b4c297d2b5ecb935570909eabcd3e6f08e613b55e8e645f2d5cd858b15edcea1fbbb1cac7db1cb82521abf7e7bf497d2fd130ec0e2b75ce0b66ce6c
SSDEEP
3072:CYQNHPn7TboFfVqQlXt4veso+nfXNyMDKieHeLvMr9y8ZoIyseKwXlc38/:C1lPn7XoOYyvxo+nfXNJD3U8D3KElcs
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
cd98c33b8c684c19e1571187a8ff3234_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Gloss
Hind
SuppS
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ