Init
ServiceMain
Behavioral task
behavioral1
Sample
fc476a3d4f2c6c77867444fb93564fb0_JaffaCakes118.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
fc476a3d4f2c6c77867444fb93564fb0_JaffaCakes118.dll
Resource
win10v2004-20240412-en
Target
fc476a3d4f2c6c77867444fb93564fb0_JaffaCakes118
Size
4.6MB
MD5
fc476a3d4f2c6c77867444fb93564fb0
SHA1
9247378a5ac2d12e611c612329138a83012e6d60
SHA256
d05c0212899f3bce96a9f617b3d34cfab902952ded43e4e21846fcfeca73e5c9
SHA512
34a6276892dad8ebbe794bf1fa26521b35d042987c9244a72a2ad4d30444a4fc35473ec290a22a22a5baa971a8bbd654b528e134e4566f5398c93d5ac921baac
SSDEEP
98304:cVHDgarH2/mxJsJKlQcPKvHb7xGAwHdPMsHhJO1:gxHcmUIi0KvxGAwHdk8hJO
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
fc476a3d4f2c6c77867444fb93564fb0_JaffaCakes118 |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
WaitForSingleObject
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
CharUpperBuffW
CreateProcessAsUserW
WTSEnumerateSessionsW
CreateEnvironmentBlock
SetupDiGetClassDevsW
ntohs
InternetOpenA
Init
ServiceMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ