guard_end
guard_start
Behavioral task
behavioral1
Sample
196ccee0aa44bd92561a52492f848eee_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
196ccee0aa44bd92561a52492f848eee_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
196ccee0aa44bd92561a52492f848eee_JaffaCakes118
Size
49KB
MD5
196ccee0aa44bd92561a52492f848eee
SHA1
962f92f740e1b692b2fcea28e9bbfccf72b64186
SHA256
1277264ed1594774bfb15612c89a2c1cb4c95660cedfdd570ae8bdc57eef34c8
SHA512
a4dd0c077062491bf64ca3d22d4263822c44ba40b8676be27a5b504fab1d000dbe0f7d4df2b88d0c34b83a41fb3cb0feb83c151616b56fa5a3247dd955631d61
SSDEEP
384:jAAI28N1xuDZbtnkmNjRqYYzOaAxf3HUq5chn6W+vDg5WVfQU+C1jnL/BQWiWH9T:sAI2axuDZbtkm+OaSpqBy08jnLBpD
resource | yara_rule |
---|---|
sample | family_blackmoon |
Checks for missing Authenticode signature.
resource |
---|
196ccee0aa44bd92561a52492f848eee_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
_adjust_fdiv
_initterm
modf
malloc
free
strncmp
_ftol
strrchr
srand
_CIpow
strncpy
_CIfmod
??2@YAPAXI@Z
strtod
sprintf
floor
_strnicmp
??3@YAXPAX@Z
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
LCMapStringA
GetCommandLineA
CopyFileA
GetCurrentProcessId
TerminateThread
OpenProcess
TerminateProcess
SetThreadPriority
LoadLibraryA
CreateThread
GetVersionExA
GetCurrentThreadId
QueryPerformanceFrequency
GetCurrentProcess
GetModuleHandleA
GetModuleFileNameA
CloseHandle
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetCurrentDirectoryA
GetPrivateProfileStringA
WritePrivateProfileStringA
Sleep
GetTickCount
MultiByteToWideChar
WideCharToMultiByte
RegCreateKeyExA
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCloseKey
RegSetValueExA
OpenProcessToken
ZwResumeProcess
DispatchMessageA
wsprintfA
MessageBoxA
GetMessageA
PeekMessageA
TranslateMessage
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
OleRun
CoInitialize
CoUninitialize
LoadTypeLi
VarR8FromCy
VarR8FromBool
RegisterTypeLi
SafeArrayDestroy
VariantClear
SafeArrayCreate
SysAllocString
guard_end
guard_start
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ