StartHook2
StopHook2
Behavioral task
behavioral1
Sample
5d498e9f6eac545646e9277f83674884_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5d498e9f6eac545646e9277f83674884_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
5d498e9f6eac545646e9277f83674884_JaffaCakes118
Size
20KB
MD5
5d498e9f6eac545646e9277f83674884
SHA1
03c902be304c17fa7ac79051f9c52468dbf0ca9e
SHA256
30b0e944da67c001bcec537481b8d8210e9e072b3c545037019495944bfccf82
SHA512
94adb448587fe8e0337ce7335c63d0c87a057a1a537370c48c3eff4d87684b52a75a5632232f1e83fd3e54b8ed95921eb979b4c5ceddc49fe4bbfcc693c74f4f
SSDEEP
384:6kAVgeBCgqlgDScz4dyGYEyHha4hAz1Q/jtkXsbLl3cSu9DNHyAm:6kcxAlgDScz4dyGNsa4hAsBRbL1cSeG
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
5d498e9f6eac545646e9277f83674884_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
StartHook2
StopHook2
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ