Hookoff
Hookon
InstallService
Behavioral task
behavioral1
Sample
28d3a13f8400b6c691d988b33d6735aa_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
28d3a13f8400b6c691d988b33d6735aa_JaffaCakes118.dll
Resource
win10v2004-20240704-en
Target
28d3a13f8400b6c691d988b33d6735aa_JaffaCakes118
Size
38KB
MD5
28d3a13f8400b6c691d988b33d6735aa
SHA1
445e59ae195e29872a7693e2c6f888c520b9d74b
SHA256
954299b63a3f934337f9dcaa278a81435d0ee245c70259b349a108ca23082313
SHA512
00e3dd5069f4512f4cd5c364010ecf66a95360412575ee9a3e350e06d62bb0a8981966a21d671af0a76db3b0bce0b209f098c8e1ed58b2349ad9b532a413fdb8
SSDEEP
768:HrYeUG0o9FfklQ3yT8Q8ORLCXuo5GiN+1MMsf:HrYeugkhRo5GiN+1Mp
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
28d3a13f8400b6c691d988b33d6735aa_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
MultiByteToWideChar
GlobalFree
GlobalUnlock
WriteFile
GlobalLock
GlobalAlloc
GetTempPathA
Process32Next
Process32First
CreateToolhelp32Snapshot
DeleteFileA
GetPrivateProfileStringA
GetModuleHandleA
SetFilePointer
GetModuleFileNameA
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
GetLastError
CreateMutexA
CreateFileA
ReadFile
GetFileSize
CloseHandle
GetTickCount
lstrcmpiA
lstrcpynA
lstrlenA
lstrcpyA
lstrcmpA
Sleep
ExitProcess
GetSystemDirectoryA
lstrcatA
LoadLibraryA
GetProcAddress
FreeLibrary
CreateThread
OutputDebugStringA
SetWindowsHookExA
CallNextHookEx
EnumWindows
GetSystemMetrics
GetWindowTextA
IsIconic
GetActiveWindow
ShowWindow
UnhookWindowsHookEx
GetDC
IsRectEmpty
GetWindowThreadProcessId
FindWindowExA
FindWindowA
PrintWindow
GetWindowInfo
SetForegroundWindow
ReleaseDC
PostThreadMessageA
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
GetDIBits
RealizePalette
SelectPalette
GetStockObject
GetObjectA
DeleteDC
GetDeviceCaps
CreateDCA
DeleteObject
SelectObject
HttpEndRequestA
InternetQueryDataAvailable
InternetOpenA
HttpAddRequestHeadersA
HttpSendRequestExA
InternetReadFile
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetSetOptionA
InternetCloseHandle
InternetWriteFile
Netbios
GdipCloneImage
GdipDisposeImage
GdiplusStartup
GdipAlloc
GdipLoadImageFromFile
GdipSaveImageToFile
GdiplusShutdown
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipFree
atoi
strstr
free
malloc
??3@YAXPAX@Z
wcscmp
??2@YAPAXI@Z
memmove
_except_handler3
Hookoff
Hookon
InstallService
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ