Hookoff
Hookon
InstallService
KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode
Behavioral task
behavioral1
Sample
28018bea0e295a2fa6aefd98f381890a_JaffaCakes118.dll
Resource
win7-20240903-en
Target
28018bea0e295a2fa6aefd98f381890a_JaffaCakes118
Size
12KB
MD5
28018bea0e295a2fa6aefd98f381890a
SHA1
49fbc6185c55f0627c0484f22f49a195894a90ca
SHA256
e4bd148df42fd5365eab93a087d8e63a9fd3de41d3a26fdd12a5af6d44b9d015
SHA512
c3f32b8b99cd2bbefecd9ef948a50b890563424d118c67e94643ff56c7bb97b4419e8a0aa6ed70c94d984d9e36668bb87927aeedd6d55f9868518a31f3238900
SSDEEP
192:9AqObz3mDHCLGnZNKeSIfoM2GawqFi6AzryJlFzzrBo+VQaHBzfo9OXsL:Qbz3IDK1IyZ86AzgFzzrBf7JXQ
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
28018bea0e295a2fa6aefd98f381890a_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Hookoff
Hookon
InstallService
KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ