?DelHook@@YGHXZ
?SetHook@@YGHXZ
Behavioral task
behavioral1
Sample
c2346752b7ea5b21f2cc1dcf4e869a63_JaffaCakes118.dll
Resource
win7-20240704-en
Target
c2346752b7ea5b21f2cc1dcf4e869a63_JaffaCakes118
Size
10KB
MD5
c2346752b7ea5b21f2cc1dcf4e869a63
SHA1
426240cd427c9dce47f55529a07bad598f7c356e
SHA256
37e9b478ae9c2e0c6415440ba195136fb31d3c925f1b0f9d5c8485e32ee29136
SHA512
2146d843aa1850bb27bccaa24ce1bedc53948d97d69a29ed9a1050e1244275ceccf4951250aac69e7f238ef5eb57a733eac4c307ce4af3e0b45a42080869e11d
SSDEEP
192:58sZHX8OXd5mI8joH5chXS8iPByqXBMMDfxFbcI2oNuTpWJRJu:58U3XwIWAgiZnqmxSI2ooTpW4
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
c2346752b7ea5b21f2cc1dcf4e869a63_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
?DelHook@@YGHXZ
?SetHook@@YGHXZ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ