Hookoff
Hookon
InstallService
KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode
Behavioral task
behavioral1
Sample
af3ac5e381830f09dd6dcc4120c33d29_JaffaCakes118.dll
Resource
win7-20240704-en
Target
af3ac5e381830f09dd6dcc4120c33d29_JaffaCakes118
Size
29KB
MD5
af3ac5e381830f09dd6dcc4120c33d29
SHA1
f366a16a108c0a6e551dc1d26965d8ab5bdbf822
SHA256
d7d65ab036c4f53809f54bd1edf850011d3dbc0466af1751b8279318e9423f5c
SHA512
460c729f59d5682873225dcbac02e67ef9eed833acd4eec9b8c42f91551ddad505ab4539c28b59336b2f2fe189ccce81922684a9d7348169702e3fe816c18820
SSDEEP
768:tBaLxv5KPsZuHof2RrMGB1Wh0NAQh2hHz32zzsMASZcLU:raCPo+WSnwhT36ASaU
resource | yara_rule |
---|---|
sample | upx |
resource | yara_rule |
---|---|
static1/unpack001/out.upx | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
af3ac5e381830f09dd6dcc4120c33d29_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Hookoff
Hookon
InstallService
KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ