HookProc
InstallHook
Kill
Behavioral task
behavioral1
Sample
6a30c22cb1bef584ac2d94f75f91c44f_JaffaCakes118.dll
Resource
win7-20240705-en
Target
6a30c22cb1bef584ac2d94f75f91c44f_JaffaCakes118
Size
27KB
MD5
6a30c22cb1bef584ac2d94f75f91c44f
SHA1
20d380021123a44d9cff6da4a87ebe9d9e82670b
SHA256
a6d5958504e873590fc4b12a81aad138e76563e0052db92992f8e6b483724ac6
SHA512
e558d0ce1c846e810df0e859900553e1bad85dcbbba7f08c9b87ed58410b57b0c570b1953a5aee3b2c6ded8913e559f6fa93de8df4c266f21d1b4bd79ac1e294
SSDEEP
384:IMq2rIfmAGo3Ur6EkdEqWYrnFe5v9a2wUrMx74lBhVyUpNiiDoKQcehtaCBw:pqRTG1r2dCYrnS9a2OxoyQiyitaC
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
6a30c22cb1bef584ac2d94f75f91c44f_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
HookProc
InstallHook
Kill
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ