Hook
UnHook
Behavioral task
behavioral1
Sample
37e82b38f000bc11e97ed28dc1eaafcc_JaffaCakes118.dll
Resource
win7-20240903-en
Target
37e82b38f000bc11e97ed28dc1eaafcc_JaffaCakes118
Size
231KB
MD5
37e82b38f000bc11e97ed28dc1eaafcc
SHA1
7760237dc64ab8961f65ae8a933b558e1b2a3aff
SHA256
6e72622f2916b6f5aea0b025378ed4f901f9301b066452374ce7a9c865ef5839
SHA512
7e6d66092de353a3375ca988b550a66190dc2c0c7675cea1a4309bc84d85bd8b3f35c9ba082b097b087f6b9b61e0ac1ae19febc84d290080744da5986bf11d32
SSDEEP
6144:3S8hlaaLuWutuPvv+2bhf+UtRtc7iIcbFOWwlhWMrtW8AGFoSC:3JhlaoQt8zboagGv/wbW7GFoSC
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
37e82b38f000bc11e97ed28dc1eaafcc_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Hook
UnHook
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE