RunDllHostCallBack
����
���ﶯ��Call
Behavioral task
behavioral1
Sample
707f982705d91c4af7c01ee5483bd369_JaffaCakes118.dll
Resource
win7-20240704-en
Target
707f982705d91c4af7c01ee5483bd369_JaffaCakes118
Size
533KB
MD5
707f982705d91c4af7c01ee5483bd369
SHA1
1566903d6571f6838cfba664e5784eb49d2fe251
SHA256
b50da45208e7f35c3edb99783f27eb268451b111a4e50cde93c744eda0859515
SHA512
385b4bceb9cbe5c7bb898b6ebfe7e6c7bca3fbbfa763c90864d12ab3aef99e285eb1da8e6c6bf3162f404df7b53bf57ea0790b2f76f7afa1ad46e5d11c85d7ee
SSDEEP
12288:SH8AlrleU1fCL4ATu7lmf9yLcU4WNm67cVOiChVvDu/xdlss:ScA1YUhCUATuIf9yLcMvhVvDGxjss
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
707f982705d91c4af7c01ee5483bd369_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
RunDllHostCallBack
����
���ﶯ��Call
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ