KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode
Behavioral task
behavioral1
Sample
29d201c9eef0f853c4c6033a42731b1a_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
29d201c9eef0f853c4c6033a42731b1a_JaffaCakes118.dll
Resource
win10v2004-20240704-en
Target
29d201c9eef0f853c4c6033a42731b1a_JaffaCakes118
Size
8KB
MD5
29d201c9eef0f853c4c6033a42731b1a
SHA1
cbd3a523988c625fc476c82016900c1525dfeace
SHA256
20bf8718a56b15d1060f2441b8f58b69739994660d19f2e36a1e64658074ecd8
SHA512
2babfb0cf8494a293446616237167066d4d797afb1477f41476785c8da889cba77bbecfc110b1419546e1b5eb96b74ac619b3fddff9c9fcddff244c63d22f687
SSDEEP
96:f/FcqDTs+2ANfl9BecyLoABqNCHezcnIzdAuvGtI0LhE7rszehTLgDxn1pTNxL78:XNb5N5eeTCHezjZuULAxrTGd
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
29d201c9eef0f853c4c6033a42731b1a_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ