fyksHook
fytzHook
Behavioral task
behavioral1
Sample
0299977f400924018fa87c2302c05ec1_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0299977f400924018fa87c2302c05ec1_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
0299977f400924018fa87c2302c05ec1_JaffaCakes118
Size
15KB
MD5
0299977f400924018fa87c2302c05ec1
SHA1
fbdb88964ac2e38002fddb9cc607a99f8fb5fc02
SHA256
617821c6a718bea8ff478265d3cd0b6970e84bf3f6c166c11eb9897332c1e51f
SHA512
a4c0a2417cfdaf51d2cde5284c2c5474ddf9714945a24a02f623440b3170d2c2d5352e395cdfb95ea059d3678bda12947f966f5f303a798b0036d365e6ff131f
SSDEEP
192:n/FjOF6vNIhpKIOsPTO80PohRYg6HW+psBbqtOUJf0w9KMjes76Ubt5vi+Q6xa:9O6ehgIO58XhRptqk9iKMjes7DtxLQ6
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
0299977f400924018fa87c2302c05ec1_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
fyksHook
fytzHook
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ