DeleteSelf
Hookoff
Hookon
KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode
Behavioral task
behavioral1
Sample
b57f2244c513202f259f42c8f0711e54_JaffaCakes118.dll
Resource
win7-20240708-en
Target
b57f2244c513202f259f42c8f0711e54_JaffaCakes118
Size
31KB
MD5
b57f2244c513202f259f42c8f0711e54
SHA1
96af7fbc6e01803ddf81c5f4b2b5298cfc2e25f9
SHA256
66b2896c48a6c37fba31c955c4d0afd3fa9ba1b110a5f7768fc57848d201d49c
SHA512
37ac5670fde0b4af10c8fa07b35db27e75faced67d2d1e303e28e61a849dc0deef2f45346587a716b423182792c4a05be2c18ffbeff0d23032227b84577ac543
SSDEEP
768:EEeWuTG1Xc2dz87WDJ9UgwH7V7eQIYkjk2X/4SvHs3WP:neWuT2dz87WXUZH7Vpn0k2Xn/s3S
resource | yara_rule |
---|---|
sample | upx |
resource | yara_rule |
---|---|
static1/unpack001/out.upx | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
b57f2244c513202f259f42c8f0711e54_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DeleteSelf
Hookoff
Hookon
KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ