Install
RundllInstall
RundllUninstall
ServiceMain
Behavioral task
behavioral1
Sample
f4851a9b321c5cc06594246c43006c2c_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f4851a9b321c5cc06594246c43006c2c_JaffaCakes118.dll
Resource
win10v2004-20240412-en
Target
f4851a9b321c5cc06594246c43006c2c_JaffaCakes118
Size
73KB
MD5
f4851a9b321c5cc06594246c43006c2c
SHA1
c7e9b2a49f12fb86edd51bd41f4fdb1ff525843b
SHA256
5f055b6b565c0609fe6601db897940ad85c3c469dad6470c7e7b54b90b757a21
SHA512
8619560c1bd2cb5033847a0ae92809fbaa86d658a3176814abd7bc47902cf86629eb42fe1e7c12ab05b94c5887b86f74ce805502136f678316d37b6737fae3af
SSDEEP
1536:hO0s6t9laAGclKen/jFnToIfHTRzr5JBAZeiFp0zA+V/R8:c0s6tien/jtTBfHTRzr5JBAZeiP0Z
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
f4851a9b321c5cc06594246c43006c2c_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Install
RundllInstall
RundllUninstall
ServiceMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ