1y?tcall
3??����??��
???���䣤������������
???��?��?aCALL1111
??����?��??��yD��
??����?��?��??D��?����?
??����D��??D��?����?
?a?��
?��?��
DT??������?
Stk3
VMP����?������???a��?
VMP����?������???��?2
��??����???����
Behavioral task
behavioral1
Sample
ec6afefdf598b545094375a5f75a45d6_JaffaCakes118.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ec6afefdf598b545094375a5f75a45d6_JaffaCakes118.dll
Resource
win10v2004-20240226-en
Target
ec6afefdf598b545094375a5f75a45d6_JaffaCakes118
Size
1020KB
MD5
ec6afefdf598b545094375a5f75a45d6
SHA1
ba78f48202d02698838309377ca4f800c3944f56
SHA256
51d35f5a5a8ef5670c35e9e57aaf4e37c0527f58730879d4516278ad6e5600f8
SHA512
a71dba78186dc100b78a9606a6e60d48f34ad506316b7293cbb378657ecdb7c6b06f08e5d1407bd1639aa40642c082d546f9ca9c099a0002d0eb2eabcda56dc5
SSDEEP
24576:EuaMNB+4pvJMd1hY6rX6beSSf7RSqHoKjoRqXixxq/M6:Edy+AJMdc6rXbSIVSq05x76
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
ec6afefdf598b545094375a5f75a45d6_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
waveOutWrite
closesocket
LCMapStringA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
InflateRect
MessageBoxA
MoveToEx
GradientFill
ClosePrinter
RegSetValueExA
Shell_NotifyIconA
OleUninitialize
RegisterTypeLi
ImageList_DrawIndirect
GetSaveFileNameA
1y?tcall
3??����??��
???���䣤������������
???��?��?aCALL1111
??����?��??��yD��
??����?��?��??D��?����?
??����D��??D��?����?
?a?��
?��?��
DT??������?
Stk3
VMP����?������???a��?
VMP����?������???��?2
��??����???����
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ