HookProc
InstallHook
Behavioral task
behavioral1
Sample
4c300cc5efeb428628782c39c6adc253_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4c300cc5efeb428628782c39c6adc253_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
4c300cc5efeb428628782c39c6adc253_JaffaCakes118
Size
27KB
MD5
4c300cc5efeb428628782c39c6adc253
SHA1
b498932f56038a77b8a9883f7fb630064482fc4c
SHA256
99c4b36b7ff5afb1203032101e3b1dc88031f059aa33f4cc6537fbe2b7b0349d
SHA512
034f4017bfce70a1bc7a059648040f3746bb920004cbe44f0895399c7df183a3614fcfcf2549500e824bdd3819e701e8bc9d30b5580d2122e54130e0b52cbe33
SSDEEP
768:gaJ07jknx5MgQ7c7/doLSmLMjTsjlXIX35A:gyxNn15mAwlyJ
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
4c300cc5efeb428628782c39c6adc253_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
HookProc
InstallHook
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ