ZtlTaskMemAllocImp
ZtlTaskMemFreeImp
ZtlTaskMemReallocImp
Behavioral task
behavioral1
Sample
24211fed171b8882342b9cd483741e4d_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
24211fed171b8882342b9cd483741e4d_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Target
24211fed171b8882342b9cd483741e4d_JaffaCakes118
Size
8.5MB
MD5
24211fed171b8882342b9cd483741e4d
SHA1
8305f2266cff1062ea633a97074a1c14e958e512
SHA256
e253b90d5278a3117721a2933f143ea39269d5a1a16758f5f7395982bc88c086
SHA512
e82d42d4f58097a449d5a722afda7b947cc6c632c30b9d15f21732b807b93b20eff02a4984fcd5ac5fb415bf90a7df2f29d1acefece0db4a7d4882ec4fd50ad3
SSDEEP
98304:a4Bq1Xftbs+DbpkQjxYBQdiQIY76dQH6CNC/Nu62L/BRxXRZAXa3L:a4BaXftbrmlQewNV7FRZk+L
resource | yara_rule |
---|---|
sample | themida |
Checks for missing Authenticode signature.
resource |
---|
24211fed171b8882342b9cd483741e4d_JaffaCakes118 |
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
ZtlTaskMemAllocImp
ZtlTaskMemFreeImp
ZtlTaskMemReallocImp
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE