DivxDecode
Hookoff
Hookon
InitializeDivxDecoder
SetOutputFormat
UnInitializeDivxDecoder
ftsWordBreak
Behavioral task
behavioral1
Sample
436db87bab14da5b096dad2c0060a564_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
436db87bab14da5b096dad2c0060a564_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
436db87bab14da5b096dad2c0060a564_JaffaCakes118
Size
13KB
MD5
436db87bab14da5b096dad2c0060a564
SHA1
c884ff10db75a5e90e5372285410ca62bec60ba4
SHA256
3ac0a174e8e3975437daf99b2a42ad4cd166a322b4dd3b16f054e1b572eea2da
SHA512
a4a293f88d6ca0b30fff7018a67fc2d3d088353d2c3246251e5a56bf14b7e47dc11709387d87bb6dfccea7e0c25ad567a9f1358f65f543f97692386dcf1a5589
SSDEEP
192:a863DqWIAequQVWgZ7zYZsXkUBI1GvwQT6IjsV2aJuahMU:a863OFquQVXZfmJUWGnT9Ku6n
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
436db87bab14da5b096dad2c0060a564_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DivxDecode
Hookoff
Hookon
InitializeDivxDecoder
SetOutputFormat
UnInitializeDivxDecoder
ftsWordBreak
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ