Hookoff
Hookon
InstallService
KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode
Behavioral task
behavioral1
Sample
36e1243a2a81e015f82c3baea98fc8e2_JaffaCakes118.dll
Resource
win7-20240729-en
Target
36e1243a2a81e015f82c3baea98fc8e2_JaffaCakes118
Size
12KB
MD5
36e1243a2a81e015f82c3baea98fc8e2
SHA1
2a348d93d2d6ccdddf3840123645fb1befe86a82
SHA256
159f6f29bba2773bee79d5c35374973f0830cc08b780c7a1013d694ae87d587b
SHA512
5370f91c9f5f09b667d3db5057d347396b6cbc30c354632df89fc741aed37d224218de2e241df916ca01400270e6353e5fe8626c0ea07e2322d9949b2e2b183b
SSDEEP
192:eAqObz3mDHCLGnZNKeSIfoM2GawqFi6AzryJlFzzrBo+VQaHBzfo9OXsL:Nbz3IDK1IyZ86AzgFzzrBf7JXQ
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
36e1243a2a81e015f82c3baea98fc8e2_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Hookoff
Hookon
InstallService
KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ