HookKeyboard
Hooked
UnhookKeyboard
Behavioral task
behavioral1
Sample
69fb40c053245757a6a7dbb0b11840cf_JaffaCakes118.dll
Resource
win7-20240705-en
Target
69fb40c053245757a6a7dbb0b11840cf_JaffaCakes118
Size
20KB
MD5
69fb40c053245757a6a7dbb0b11840cf
SHA1
d983d0cbabdd031a2c8289ed5adb970e1d42996e
SHA256
405090735b7cfaf14903224c659781778ad2e2a295bd8da7410fcba2f1cde8b2
SHA512
5f216f0b23396cdc721e7edc431d0cdfe178f4df3ba7641e105fefbff62979856dcf6ea8189c5ff4bfb70efb030da5c17a0cc35e11f7c6ceac91e83937eec2f7
SSDEEP
384:ft9vkkcQm9IQZZ5bz2IK4lArOKqK4KP9siK6psMpup:ftFhu9IMnJArbsjyup
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
69fb40c053245757a6a7dbb0b11840cf_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
HookKeyboard
Hooked
UnhookKeyboard
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ