KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode
Behavioral task
behavioral1
Sample
5e69120721e3f82d5ac542f899c92e2e_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5e69120721e3f82d5ac542f899c92e2e_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
5e69120721e3f82d5ac542f899c92e2e_JaffaCakes118
Size
8KB
MD5
5e69120721e3f82d5ac542f899c92e2e
SHA1
7b5328be2fe59463d0a5e6f178cae3ef1b676ee3
SHA256
252858e85ac94c0919a3e7364fdd75fe596ed51de7d1225aef93ae5c7780d712
SHA512
ba4ce11477d97d81293e5e74e0168bb291a57e4f67fc03417ccda91b7dd5bf9682a392681f13ee088a41847e0c41ec792df3683f0f70ba8d41693bf2088be71a
SSDEEP
96:r+24OvfWblh7kehKaMyRFqAoG984a6qrewe5H9jXbUu44pgEzQv6McI0cd4V4Mgm:RfknR339ule75dn44eKGJIV7z
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
5e69120721e3f82d5ac542f899c92e2e_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ