GetLevelAndItem
SetDIPSHook
SetMIRSHook
Behavioral task
behavioral1
Sample
cf449d67b626de4b3dc635f13402dc85_JaffaCakes118.dll
Resource
win7-20240903-en
Target
cf449d67b626de4b3dc635f13402dc85_JaffaCakes118
Size
6KB
MD5
cf449d67b626de4b3dc635f13402dc85
SHA1
82addc6b312c8c289411e0fcc15f50757a7f9b57
SHA256
f3eca3315813c952e3473547f252e07d107598344522488e0877314434122007
SHA512
1a957ae99cffe43e97f99f197cff756f9db2e4b82789dafa9ec180a64f17a4eac7d852e351e5b3843c07d5ebc35d126231ef8e9f01cacd147bee190a18f98586
SSDEEP
96:ZfcLKSZeae3GcqNpYyWP2UwNBAjFJB4nlu6qg3t:ZfwKSQWcuYFunNBQFJenw
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
cf449d67b626de4b3dc635f13402dc85_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetLevelAndItem
SetDIPSHook
SetMIRSHook
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ