RY2_Close
RY2_Find
RY2_GenUID
RY2_GetVersion
RY2_Open
RY2_Read
RY2_Write
Behavioral task
behavioral1
Sample
0df735dee30be573ce76fbc70076903a_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0df735dee30be573ce76fbc70076903a_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
0df735dee30be573ce76fbc70076903a_JaffaCakes118
Size
104KB
MD5
0df735dee30be573ce76fbc70076903a
SHA1
57cd1f9895b38c3fa803638b05233bf6c5fabefa
SHA256
90dce062a5d6aa991d4552caa09533f340305eb504413dca9f74861680b6e6a0
SHA512
61fea491b6b9835351b373671eba472faaa4e5572794b22f597d46958714f34b49815620b478daed292a4ea5243c4c0606df1cc2411c11bdb2db113191cf2687
SSDEEP
1536:GnDhC7/Jb9RD2pDtCEQDx9s6zH7Sv0MfLu77z7aPPvicF3wKcUeMp3B7p+D5je:ehC7/JJc3CEeDzYfLGKX/VdF3B7pw
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
0df735dee30be573ce76fbc70076903a_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
ReleaseMutex
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
wsprintfA
MessageBoxA
SetupDiDestroyDeviceInfoList
HidD_GetHidGuid
RY2_Close
RY2_Find
RY2_GenUID
RY2_GetVersion
RY2_Open
RY2_Read
RY2_Write
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ