SetDIPSHook
startNow
Behavioral task
behavioral1
Sample
f2730977cae16a0156cf37f89e9633cf_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f2730977cae16a0156cf37f89e9633cf_JaffaCakes118.dll
Resource
win10v2004-20240412-en
Target
f2730977cae16a0156cf37f89e9633cf_JaffaCakes118
Size
19KB
MD5
f2730977cae16a0156cf37f89e9633cf
SHA1
5c2b2fb7990e03d5a26d56776a3c06659292f308
SHA256
c2571b2534779c91c35e8241b932d8b725b446ce7c07b76114a955691756f44c
SHA512
1cb542fbe58672b1f0a5c075a1a71b72135fe0b0db45e3283a5417fe1bf359344bb5ca9a2ecd4307f0cef09706bbaee6d73d805e68908e178035343500fc994d
SSDEEP
384:w/+pXV5nw5k7BmbNkCDiPobdwZOU3+VXP5iq/Qmr6Zi/MIVlj451W0PdOj5Jv:UgF227IkCDiPEdwFuxs1IHc5FPCzv
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
f2730977cae16a0156cf37f89e9633cf_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
SetDIPSHook
startNow
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ