GetMsgHookOff
GetMsgHookOn
ThreadPro
Behavioral task
behavioral1
Sample
081213d8a5554f63b45e1e3661d6206e_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
081213d8a5554f63b45e1e3661d6206e_JaffaCakes118.dll
Resource
win10v2004-20240611-en
Target
081213d8a5554f63b45e1e3661d6206e_JaffaCakes118
Size
22KB
MD5
081213d8a5554f63b45e1e3661d6206e
SHA1
0a8e2cbed8016711c55bd7c0f3b449c1e0b299f1
SHA256
f2403d15a41421157b78f0a793a718eb9d050634d4e0755bbb9f171603341830
SHA512
76e8003a9b8e59bd113f30d20f250f033d12cb1328177342cb11b15abd8ea4df8941061b24279d5f7a3e9b4846ea1558e1541bed8b50010d08b7f079fc929bd3
SSDEEP
384:caI24Moph/rBmXx4MvtAiWdkZ1IA1Dsj5WzkZuE14FeIq6/vCC7tW725j:caI2yJBmB4MveHk0A1Drtvq6/vhsa
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
081213d8a5554f63b45e1e3661d6206e_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
GetMsgHookOff
GetMsgHookOn
ThreadPro
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE