hide_get
hook_kbd
un_hide_get
un_hook_kbd
Behavioral task
behavioral1
Sample
4478971be78b4164b86168adb94b134a_JaffaCakes118.dll
Resource
win7-20240708-en
Target
4478971be78b4164b86168adb94b134a_JaffaCakes118
Size
5KB
MD5
4478971be78b4164b86168adb94b134a
SHA1
a0064b7d43b04c70e604df4fbd34ff605e9d1e01
SHA256
e17f4c06e337582133e64a49efc53c4bf9ea1573e43b00e34add5fbe42cb3751
SHA512
0510cf602fc7e558aed375302d5c9eaafc3f4419692e69d39159293161b573bb942375334ddce87faf8bd6f9ca7bbf9d6bfbb1063c0ca724c1f83967d9f9bc85
SSDEEP
96:ZH9h87gqatEr9qxe5wgKmDh0nOxy7SYEifRYqRnz8W+QXDY4u:27gqeEr9gFFm9q5N+QX
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
4478971be78b4164b86168adb94b134a_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
hide_get
hook_kbd
un_hide_get
un_hook_kbd
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE