HookKB
HookKBLL
HookSHELL
UnHookKB
UnHookKBLL
UnHookSHELL
Behavioral task
behavioral1
Sample
00480a5c453bc9c66b7016041ee1a80a_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
00480a5c453bc9c66b7016041ee1a80a_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
00480a5c453bc9c66b7016041ee1a80a_JaffaCakes118
Size
222KB
MD5
00480a5c453bc9c66b7016041ee1a80a
SHA1
ce477a1dc9bcd207d37f2aa94ee135cab0c57a9e
SHA256
9662ecbf23106ff9140c9b00ef8164ac666c58cbab387c33093de223350d6301
SHA512
b47bde3ae7fe5ce63eef1ff4f982fd052a9af3e2cc79543253c81bff2e6f7fd8b1e3a43befa7a53e14b21ee5a9dacbd82a321d9e44dda86aa5f5b8c023ac2c03
SSDEEP
6144:k362WhWk6mx+PsE5+NM1x0cPoIQsWtZSmmTdfyRj7K:kUUmxBE5+NMUcPgsWt0mEM17
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
00480a5c453bc9c66b7016041ee1a80a_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
HookKB
HookKBLL
HookSHELL
UnHookKB
UnHookKBLL
UnHookSHELL
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ