RunDllHostCallBack
����
Behavioral task
behavioral1
Sample
0670a0678285f565d06428f7f26196ec_JaffaCakes118.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
0670a0678285f565d06428f7f26196ec_JaffaCakes118.dll
Resource
win10v2004-20240226-en
Target
0670a0678285f565d06428f7f26196ec_JaffaCakes118
Size
860KB
MD5
0670a0678285f565d06428f7f26196ec
SHA1
d7fc01af33f44bc055caf7b80993de688f86c6c6
SHA256
cec482e7a28b6a62a06d3280462b70e39eb5c4b1a1d4677b6b30da7a87323d18
SHA512
43271744a1293006228659ad1c15379585ed91cbda7527ab968f412e7894e81cc9467373914378ed3510e17d0c3e2fe899f742a68f81231ec60359e2032bec95
SSDEEP
24576:g5fUQUtL+jTs8GCi4MQDQsY5emrfet29k/Y+:gpUBR+PsHCVksmf76/d
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
0670a0678285f565d06428f7f26196ec_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GlobalLock
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
GetClipboardData
MessageBoxA
SaveDC
midiStreamRestart
ClosePrinter
RegCloseKey
SHGetSpecialFolderPathA
OleUninitialize
UnRegisterTypeLi
ImageList_Destroy
accept
GetSaveFileNameA
RunDllHostCallBack
����
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ