StartHook2
StopHook2
Behavioral task
behavioral1
Sample
f08ac2a9f436dd4d14d9f5849e97598c_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f08ac2a9f436dd4d14d9f5849e97598c_JaffaCakes118.dll
Resource
win10v2004-20240412-en
Target
f08ac2a9f436dd4d14d9f5849e97598c_JaffaCakes118
Size
21KB
MD5
f08ac2a9f436dd4d14d9f5849e97598c
SHA1
64deecd7647befe2096ee56c9ebbdb57604b1b4a
SHA256
1b2939760a92d1490c5529c168d61d46e4c0b606f4c5501e1ff2b0c9db369e09
SHA512
7c343299106ee7dbca1885131af65af2766e153a0d687dc0f2d2aaee4b56a9ddea5706be0e74953ab3a2abc4c7d3fafb44a50fc9c6d412c4e21e64d899fe01a9
SSDEEP
384:ekAVgeBCgqlg8P5NyP2IaivBHqSr0G8xRhaPaKsA4UTl6:ekcxAlgOLO2jiv1qCZUOEs
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
f08ac2a9f436dd4d14d9f5849e97598c_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
StartHook2
StopHook2
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ