StartHook2
StopHook2
Behavioral task
behavioral1
Sample
ec4f393afa7e8acf6ad281d44e7c168f_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ec4f393afa7e8acf6ad281d44e7c168f_JaffaCakes118.dll
Resource
win10v2004-20240226-en
Target
ec4f393afa7e8acf6ad281d44e7c168f_JaffaCakes118
Size
21KB
MD5
ec4f393afa7e8acf6ad281d44e7c168f
SHA1
1f9a92dfeb58118e50732cd001afd00d5a9df081
SHA256
dd1cacaa853487a7bcd46739110b517075cd9ce1710cd566814e1ea8ec19f4fe
SHA512
d73007ea71c4362a46a6289c454e9d2af91ca1ec8f81a5f387f324fae6778f96d6f5580d0fe7744e7ccd64f6c5bb33dbbc7829242f5a9604ee0f8fb17ca8cdcf
SSDEEP
384:LkAVgeBCgqlgqbzvZBY47lSftU72Uj3OPwfj8tSLG6t:LkcxAlgSDMaotU7Zj3qw7L3
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
ec4f393afa7e8acf6ad281d44e7c168f_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
StartHook2
StopHook2
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ