RunDllHostCallBack
_�����ӳ���
���궯��
Behavioral task
behavioral1
Sample
a5b4ebd8f2bc667326cd9e143afb8ed8_JaffaCakes118.dll
Resource
win7-20240704-en
Target
a5b4ebd8f2bc667326cd9e143afb8ed8_JaffaCakes118
Size
317KB
MD5
a5b4ebd8f2bc667326cd9e143afb8ed8
SHA1
b8909737687df8879b4de9b1c485dd2594062240
SHA256
a2787784c7ee91c1d37b3be6895b2e289619d01129c2de87997f04250430a1e7
SHA512
f04602d54e19501b4b94255b6d41d41bba0dbafd0d8cb850960b32e010a9c2a193f9c6bd2a4383201b43c825e38a7f1e21157e5039e79312ab853ac8c432c0d4
SSDEEP
6144:Excm6+bjjzTtKkTVSfIngHwnMnFZRdqw2JarcALksdrUY6dK6oeuzZ3IV:Y6+fjflsCgQnMnFZCFarpIsdYdVoeuzO
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
a5b4ebd8f2bc667326cd9e143afb8ed8_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
RunDllHostCallBack
_�����ӳ���
���궯��
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ