JLI_CmdToArgs
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Behavioral task
behavioral1
Sample
6048e9361c3789c78ef93a9291beacc5_JaffaCakes118.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
6048e9361c3789c78ef93a9291beacc5_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
6048e9361c3789c78ef93a9291beacc5_JaffaCakes118
Size
10.0MB
MD5
6048e9361c3789c78ef93a9291beacc5
SHA1
cf8a05ba0aef127e811414b7ae1059b1755512de
SHA256
fbb8125816b672c13c34305ba11aa5fc175fa032a6d53604c52d1dd4d7751446
SHA512
4e5112c24635ef0fd37cec17d4a46fb376aa083b6eec3777b22899d289fe6966704b6595535fa64258c4afec1f92c7dada89fc8696a66539919f236ee0b9cc2f
SSDEEP
196608:so9beZyYCkn0+UQKFSLmH/4Q08NXVBdvaTL2y+E2Qk2TDG41K88kP:P9iZy7tQKgLmfV08NXVBdCZ2QX+41K8d
| resource | yara_rule |
|---|---|
| sample | vmprotect |
Checks for missing Authenticode signature.
| resource |
|---|
| 6048e9361c3789c78ef93a9291beacc5_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
SysFreeString
SafeArrayPtrOfIndex
GetErrorInfo
RegQueryValueExW
RegSetValueExW
CharNextW
SetClassLongW
EnumDisplayMonitors
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
GetVersion
GetProcAddress
GetVersionExW
GetVersion
Sleep
MulDiv
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
UnrealizeObject
VerQueryValueW
NetWkstaGetInfo
OleUninitialize
InitializeFlatSB
memset
ShellExecuteW
SHGetFolderPathW
URLDownloadToFileW
MagSetImageScalingCallback
WSACleanup
sqlite3_bind_parameter_index
CryptUnprotectData
timeGetTime
WTSSendMessageW
JLI_CmdToArgs
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ