ksHookwo
tzHookwo
Behavioral task
behavioral1
Sample
f2bc7a599b29a11afb673cec7a085f77_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f2bc7a599b29a11afb673cec7a085f77_JaffaCakes118.dll
Resource
win10v2004-20240412-en
Target
f2bc7a599b29a11afb673cec7a085f77_JaffaCakes118
Size
13KB
MD5
f2bc7a599b29a11afb673cec7a085f77
SHA1
936e44b2090715563ea2dba35d348a668630725a
SHA256
76c5459dd2ed7b824eed263e62f088f9cd82e1842504c73d6377f963515a0d9b
SHA512
4b4a0ba8979ba55663fd7069580884c9e405730166af68659d338ffccd8ce4ede34f27d1d0bd9f49e42efc45b25d08bfee0ea66b70606b2b12c1d405120735b3
SSDEEP
384:ReuVUFFqp86oEtQO7c90BCpvjiGgk9W3f4ZQ:ReOzplo8G+EpvEHd
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
f2bc7a599b29a11afb673cec7a085f77_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
ksHookwo
tzHookwo
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ