tl_ksHook
tl_tzHook
Behavioral task
behavioral1
Sample
a06414ab88c8f1f5a07d394e5c39012e_JaffaCakes118.dll
Resource
win7-20240708-en
Target
a06414ab88c8f1f5a07d394e5c39012e_JaffaCakes118
Size
14KB
MD5
a06414ab88c8f1f5a07d394e5c39012e
SHA1
9a6ec07500908ea05466fb155410816347ea7633
SHA256
fea18eb1fc82e10d9e0a0b997126226df5896dd73558935ffdcaf348ae0eaca2
SHA512
0cc99ccb33f236ed968172d5eccaf94b0a70daf9bfa3054651da7a6dd046a647ad2963427f9306e8843d5c72292443e4433fb238a1bc2b80cdc008c90824d20d
SSDEEP
192:n6NLVP/vku6SN+dVTVITL+eyG2GwzhJ8jK3kI1HzG49yS+yu6bh2aOp5tFYQv5a:6NLpRN+dVTVITL8Uwzf8jcd9uZ5Vha
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
a06414ab88c8f1f5a07d394e5c39012e_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
tl_ksHook
tl_tzHook
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ