StartHook
StopHook
wd_ksHook
wd_tzHook
Behavioral task
behavioral1
Sample
89763f3b7f2d29ad8088e4727148f257_JaffaCakes118.dll
Resource
win7-20240704-en
Target
89763f3b7f2d29ad8088e4727148f257_JaffaCakes118
Size
15KB
MD5
89763f3b7f2d29ad8088e4727148f257
SHA1
bb9abcfa9003d15117be9d4728acf582263ec41a
SHA256
859cbc65c3cf70eb44bf5ff44235a24bf6018e1b1a168ebc77d2b1ca129d21b4
SHA512
78340bb93354de78377059567a1e0ba9acac9e2936d11dc8e13946aee7ee2e6e419822f277fa5417574f54d56c1f1918a9f85f569ac9c9b61f1aead9869af504
SSDEEP
192:nA2/lNU3cCeeC70bb+zMScmpz8P/1/Ul/i5wqCiCYhXpkDGcS5VADgbpLQmt:AUl2HeFtF21/o/+wqxGDjmADgN8m
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
89763f3b7f2d29ad8088e4727148f257_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
StartHook
StopHook
wd_ksHook
wd_tzHook
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ