hook
hqjb
Behavioral task
behavioral1
Sample
102a5ae2cc99b86c8f5906154643f628_JaffaCakes118.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
102a5ae2cc99b86c8f5906154643f628_JaffaCakes118.dll
Resource
win10v2004-20240611-en
Target
102a5ae2cc99b86c8f5906154643f628_JaffaCakes118
Size
215KB
MD5
102a5ae2cc99b86c8f5906154643f628
SHA1
c800eaa45f5d5e6452a71fb03784122d00d9904c
SHA256
95c4c5e3347b5256d6598870b19788ccfe91963c7754bfd6b1a405c99b4f7a77
SHA512
77b6733a7682567eb4e6ccce6f6fb7b2ba4fe6a2b0f1c65720e4b47ca354acdc2ed7ecdf86e4c6eae5848729577bf8b1e44dc51a33befd371ff9fe4e3f29a7fd
SSDEEP
3072:LuvTX+y2xIl4AJfUBq75QPYIdKptET48nDYXDcK7TbxPo2SJ2p+M9XMgP:DzuRd1kHC92sTcK7fxQJ2/9b
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
102a5ae2cc99b86c8f5906154643f628_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
MessageBoxA
MessageBoxA
FreeLibrary
lstrcatA
GetModuleFileNameA
ExitProcess
LoadLibraryA
GetProcAddress
lstrlenA
VirtualProtect
GetModuleFileNameA
ExitProcess
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
hook
hqjb
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ