HookOff
HookOn
Behavioral task
behavioral1
Sample
6503907c400c99b88fc1633cac9aa046_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6503907c400c99b88fc1633cac9aa046_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
6503907c400c99b88fc1633cac9aa046_JaffaCakes118
Size
9KB
MD5
6503907c400c99b88fc1633cac9aa046
SHA1
5d2f33b5322b207bbf756ca978d6b85d7f4d6969
SHA256
da8cf1b0804cf4ebe24620947343dd3b93ad970cc9fc879f329ccaa499f4871f
SHA512
e7a19e9f60a77447ed630ba27beffc497e1e5bfccc9ec47ff3a34cd0b651084005333ab2ce8b0c4ec9313251269a7fa0818a9355abc1c46a7733df670635d015
SSDEEP
192:nwvqijC1qAnS530R/JhrCncDNwxQ8VYFrRYTq3HyAdd8:kbjwqAnxJ9+SNwxzVY2q3r
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
6503907c400c99b88fc1633cac9aa046_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
HookOff
HookOn
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ