AddReply
HandleEventHook
RegisterCallback
Static task
static1
Behavioral task
behavioral1
Sample
d0653d93dea6f6e9edce35c8ace49d91_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d0653d93dea6f6e9edce35c8ace49d91_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
d0653d93dea6f6e9edce35c8ace49d91_JaffaCakes118
Size
152KB
MD5
d0653d93dea6f6e9edce35c8ace49d91
SHA1
70063446d33a9b2ed5bda0cb0891c18744285042
SHA256
aef30ffc1f00081eb7a26c5bf5ace7a1b4befdefa55f15ceaf41d25cde13fa35
SHA512
376c8e3cd150b5a796b60b58e2fdc2fe7e66f0bbc6c962942dd6e57607221246d5ddbd38a7107afa5b7487bc02c14278f2e432327c9a39c3b451d514245356b0
SSDEEP
3072:R96+ZEz3fuqZk9g35MUjwT+rOR9lbOiKZYJCoJYaB0LTPhXazN:aFz3fuqKy3iUKBRbRK23YaB0HpqB
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
Checks for missing Authenticode signature.
resource |
---|
d0653d93dea6f6e9edce35c8ace49d91_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetProcAddress
GetModuleHandleA
LoadLibraryA
ExitProcess
MessageBoxA
AddReply
HandleEventHook
RegisterCallback
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE