EndHook
StartHook
Behavioral task
behavioral1
Sample
baa09c43907eca67caf35bc44c6426b7_JaffaCakes118.dll
Resource
win7-20240704-en
Target
baa09c43907eca67caf35bc44c6426b7_JaffaCakes118
Size
46KB
MD5
baa09c43907eca67caf35bc44c6426b7
SHA1
6b95dc45f211114df0381d61e13a57c1cd1ff061
SHA256
a86e7271d66396a8fc09e8507c25f97d3203a6a4561132223b598cf2869cd036
SHA512
d535583fe1fe11cdb4ee0aaba51ed47e4e2d05f3d826ee02ae69dc07e57c1f165662c6e5eeecf7c8bae349ec0aadc16930dde4edb6f2ff03e12daec2a3ba16d6
SSDEEP
768:oBryob1sGiu8Q8WmQVhLr/XXnZayZp3id5s/aP9qINpg29bCOQai4nAD:oBryohBiyPmQV9r/XXtpVCP9tNvIv3LD
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
baa09c43907eca67caf35bc44c6426b7_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
EndHook
StartHook
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ