_LOADLIBRARY_DUMMY
_RunAs@16
Behavioral task
behavioral1
Sample
2728e17583a660ffdd5305f902166813_JaffaCakes118.dll
Resource
win7-20240508-en
Target
2728e17583a660ffdd5305f902166813_JaffaCakes118
Size
100KB
MD5
2728e17583a660ffdd5305f902166813
SHA1
418df8493d534530766011edd837b8d161fb5a49
SHA256
436c0a4dd6f97b9fd01987b88dcc751093837d1d9c15ecbb89d44e2108edd854
SHA512
870131c6aec2bea6b2ca9045fdd9eea5db9042d0749b774a3be7aef7170f66eba9012a58a37b16b117cacb81d361df0de8fa9f9d82b4727b09d9ca756b415e59
SSDEEP
1536:8ZerBkpioMmiZaXz5wAA8CszrH8DSNRUampxk+zN4cfO1D837xbBq7wUDi3+:NGViU9A0vWhpxk+hJxUNu3+
resource | yara_rule |
---|---|
sample | upx |
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
2728e17583a660ffdd5305f902166813_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
_LOADLIBRARY_DUMMY
_RunAs@16
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ