Certeza
TMethodImplementationIntercept
Behavioral task
behavioral1
Sample
30e584b11d7945dde5b3e8ddb53e0533_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
30e584b11d7945dde5b3e8ddb53e0533_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
30e584b11d7945dde5b3e8ddb53e0533_JaffaCakes118
Size
9.4MB
MD5
30e584b11d7945dde5b3e8ddb53e0533
SHA1
b92f138b80698312bd013f809896ac154bda9f4b
SHA256
a3b15600e3e2441921499ac4a10d0a78cd8f55d1cdcced5bbe576e7f96e9cb5c
SHA512
efb1a2af224ec97ab8c6a9610e4c570739cf29f606790089123da36ba42d885f75015dacdcdcad453dac101900268e900181cf97ca1820bdf47398e12ec42ffc
SSDEEP
196608:wMcH04Vu/2oxs2mxrFj55QQOiCLZW0FFl0RXHRQOhyP7fSGW8Gy:wP06u/2oxs2m3j5ciCTDmR3RxhyDJd
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
30e584b11d7945dde5b3e8ddb53e0533_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
SysFreeString
SafeArrayPtrOfIndex
GetErrorInfo
RegQueryValueExW
RegUnLoadKeyW
MessageBoxA
SetClassLongW
EnumDisplayMonitors
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
GetVersion
GetProcAddress
GetVersionExW
GetVersion
Sleep
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
UnrealizeObject
VerQueryValueW
CreateStreamOnHGlobal
InitializeFlatSB
memset
ShellExecuteW
SHGetFolderPathW
OpenPrinterW
GetDefaultPrinterW
WSACleanup
WTSSendMessageW
Certeza
TMethodImplementationIntercept
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ