DeRegisterShellHook
RegisterShellHook
Behavioral task
behavioral1
Sample
330798d21feb7ae32328954a9015193a_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
330798d21feb7ae32328954a9015193a_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
330798d21feb7ae32328954a9015193a_JaffaCakes118
Size
11KB
MD5
330798d21feb7ae32328954a9015193a
SHA1
5287cfa1349553f7e0cc4f44923f87dc83a9974b
SHA256
4f2bf982e93c4ff9b0e2583d5b76db59dfcfe00bdffe1f8ca826431fbb6bd150
SHA512
e9de8fc762e377da8c0ca9ea2ea4648fa83ecb590abfa738282b922caf085f277f4d9f33a2d7a37c7ebad0aac0b505222c74999a03cb987054494cf030b6f0b8
SSDEEP
192:v7VJaRtW420f0vKCT2jpixvKthAQPH4t99g7WUJmVyDb6j7NgNZM:vX0w10qnCjp8gPMY5JmVY6T
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
330798d21feb7ae32328954a9015193a_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DeRegisterShellHook
RegisterShellHook
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE