APC����
RunDllHostCallBack
����
����
ȡ��������
Behavioral task
behavioral1
Sample
3caad6040d95f1e640d0f75884b4c81b_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3caad6040d95f1e640d0f75884b4c81b_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
3caad6040d95f1e640d0f75884b4c81b_JaffaCakes118
Size
481KB
MD5
3caad6040d95f1e640d0f75884b4c81b
SHA1
a67021c474762c5ef95e26118538eeb8e4fed61e
SHA256
947a53004935428accc4f345613d2ad4d671c2355d17574397d186913af2f653
SHA512
0a172e40c54a99e7b9f11b016562bee78c77c011a6d1f0902c5e98499f691a17d5abccf4d3a2392488137162e75c1e49074279e4fda7bdf3c55e25d7aa428320
SSDEEP
6144:ZH/dEZsz1WjBySfuYKHyELe+SJvl/SEOdLpKCFHXXPoFhHA9SKd5weTMkPY06atK:l1EZsSqaft/SZLUCFHP2hTKIEF3kr
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
3caad6040d95f1e640d0f75884b4c81b_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
APC����
RunDllHostCallBack
����
����
ȡ��������
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ