Install
Launch
ServiceMain
UnInstall
Behavioral task
behavioral1
Sample
254b984d9259d24403583957f5647517_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
254b984d9259d24403583957f5647517_JaffaCakes118.dll
Resource
win10v2004-20240611-en
Target
254b984d9259d24403583957f5647517_JaffaCakes118
Size
612KB
MD5
254b984d9259d24403583957f5647517
SHA1
78647e6456623c2bf9c69b078b4dd2464b722fd4
SHA256
273cb15839dd08bb0977404d9d0db462dc61c73b88b29e2eb79bbe7b4339c2c0
SHA512
c8261ed722b906c4de185033dcc47d11af00f91af970f23afc80ebaa52bf27984398d4003ffe1f777d32acad3a6295360da3ba92d2906012c523ee1b3dfe1789
SSDEEP
12288:x7O9KBiABbqtPU/oAhfejKHdTt2EMzgbGO:ZvN5DftqzkSO
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
254b984d9259d24403583957f5647517_JaffaCakes118 |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
inet_ntoa
InternetOpenW
StrStrW
ImmGetCompositionStringW
mixerSetControlDetails
GetModuleFileNameExW
CreateEnvironmentBlock
GetModuleHandleA
GetModuleHandleA
GetProcAddress
VirtualProtect
SetWindowsHookExW
BitBlt
CreateServiceW
ShellExecuteExW
CoInitialize
SysFreeString
Install
Launch
ServiceMain
UnInstall
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ