Hookoff
Hookon
InstallService
KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode
Behavioral task
behavioral1
Sample
05648c6876cb4d08229c8a9f6ba5f1b9_JaffaCakes118.dll
Resource
win7-20240903-en
Target
05648c6876cb4d08229c8a9f6ba5f1b9_JaffaCakes118
Size
12KB
MD5
05648c6876cb4d08229c8a9f6ba5f1b9
SHA1
c8f7b360f84a059d95d6733967c89a04b87e6d67
SHA256
f4c60b6d151a0cbbce339c80027a1d6cb3f67033e2c1bb0ffee0f3dd6607ebab
SHA512
a88898da70e802533af9a7e2dd50956aac4d7b557392da78daa35bce89a573f63cf9145334f948f0421dfd74474242321751fc06158c38214dfc8b6d30bb81ae
SSDEEP
192:0vQqQLVXh8gaFLKlcMsDBe4dGTLlPG4pdAaTXdjjBxXp4eh6JhU89zvE4:0vaVmzFLNDDBe9TLlb7Xdjjrns+8tv
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
05648c6876cb4d08229c8a9f6ba5f1b9_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Hookoff
Hookon
InstallService
KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ