ksHookwo
tzHookwo
Behavioral task
behavioral1
Sample
38ea4eeeec729bbfac44a693b9e822b9_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
38ea4eeeec729bbfac44a693b9e822b9_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
38ea4eeeec729bbfac44a693b9e822b9_JaffaCakes118
Size
13KB
MD5
38ea4eeeec729bbfac44a693b9e822b9
SHA1
87a16f0777653b6d36706c424cd101ab8f5694ad
SHA256
426fac2c40118d91d2750f799456f9143dba5c8df22e4d2b45a9aa70292db924
SHA512
4c28e1cb2a1b8e3abac5a0842fb2170ddc7947b379bb0131c0c6c98e9c9605617d22026a17d9fdc64f1c3dc62063a87b178c3dc5cc58fb73369410bbe6a8f375
SSDEEP
384:1euVUFFqp86oEtov3yw0rwnrLEHisxcTUfx:1eOzplo8DRr+Tsxc
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
38ea4eeeec729bbfac44a693b9e822b9_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
ksHookwo
tzHookwo
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ