HookKB
HookKBLL
HookSHELL
UnHookKB
UnHookKBLL
UnHookSHELL
Behavioral task
behavioral1
Sample
a884cc4a7e0083f86fedb33f4c9b2abf_JaffaCakes118.dll
Resource
win7-20240704-en
Target
a884cc4a7e0083f86fedb33f4c9b2abf_JaffaCakes118
Size
222KB
MD5
a884cc4a7e0083f86fedb33f4c9b2abf
SHA1
89deaba43e410d0ab549234f4ffadf546b7ea270
SHA256
42b5ecca6d38f039ff486831617c70666a4a0ca6e0b391eee6faf5c063c0e903
SHA512
cdb1e54b5ed09a23541ec0c8131191b72215a1507e9f8cbc3e7fb5b0a7b2d75aae5fd94357d8ce88ca841c31fa9d63feb3046bd6e62ad3b040720be81870b42e
SSDEEP
6144:S362WhWk6mx+PsE5+NM1x0cPoIQsWtZSmmTdegkT:SUUmxBE5+NMUcPgsWt0mEQ9T
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
a884cc4a7e0083f86fedb33f4c9b2abf_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
HookKB
HookKBLL
HookSHELL
UnHookKB
UnHookKBLL
UnHookSHELL
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ