DoWorkEx
DoWorkWl
Behavioral task
behavioral1
Sample
2a0ecd919dfe2dd0beefe6b2ce210e56_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2a0ecd919dfe2dd0beefe6b2ce210e56_JaffaCakes118.dll
Resource
win10v2004-20240704-en
Target
2a0ecd919dfe2dd0beefe6b2ce210e56_JaffaCakes118
Size
41KB
MD5
2a0ecd919dfe2dd0beefe6b2ce210e56
SHA1
4e84adcd1350b545fbdcda8a2b9441f1235df913
SHA256
284a93c497c26612938c9834cd7ef30efa1f8c0fb6f65d081236d55b31e327a9
SHA512
b8b84560b4f039162ba7ba41816f5bc0eb21d17b5d8187b0e06f48d4d66a29f047f9ab0058bd4c70b1d963c3696673cdcaf1f768f04f8d27f81026f152bf4e74
SSDEEP
768:pZSj0aV2KEGqI18upBHDFieiwt5EI5mbGNVeeD3byt:Jal3+yHUzwJkSDSt
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
2a0ecd919dfe2dd0beefe6b2ce210e56_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
lstrlenA
CloseHandle
WriteFile
CreateFileA
lstrcmpiA
GetModuleFileNameA
DisableThreadLibraryCalls
CreateThread
SetFileTime
GetFileTime
GetEnvironmentVariableA
Sleep
DeleteFileA
FreeLibraryAndExitThread
ExitProcess
WaitForSingleObject
GetProcAddress
lstrcmpA
ReadFile
SetFilePointer
Process32Next
Process32First
CreateToolhelp32Snapshot
OpenProcess
CreateProcessA
GetSystemDirectoryA
GetStartupInfoA
VirtualFreeEx
CreateRemoteThread
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx
lstrlenW
MultiByteToWideChar
GetCurrentProcess
lstrcpyA
FreeLibrary
CreateEventA
LoadLibraryA
wsprintfA
WaitForInputIdle
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA
InternetOpenA
HttpQueryInfoA
InternetReadFile
InternetSetOptionA
InternetCloseHandle
InternetOpenUrlA
??2@YAPAXI@Z
_adjust_fdiv
malloc
_initterm
free
_except_handler3
memcpy
strchr
memset
??3@YAXPAX@Z
__CxxFrameHandler
_EH_prolog
DoWorkEx
DoWorkWl
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ