Install
RundllInstall
RundllUninstall
ServiceMain
Behavioral task
behavioral1
Sample
32725a4ea69ec50c52936c2ed99ac68a_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
32725a4ea69ec50c52936c2ed99ac68a_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
32725a4ea69ec50c52936c2ed99ac68a_JaffaCakes118
Size
127KB
MD5
32725a4ea69ec50c52936c2ed99ac68a
SHA1
1fab8f2407f7479561addb40a5ab11c17eb787d2
SHA256
b77b091fa7e63340d4ee2503888d75d74a061047d57509006f18b2b5e3d24253
SHA512
c83be6807fa7a2998852f1e4ad075221a62df7cd47f56dbe1ad8a4952e780bd0a32676c119e73b521b3b4eb1ea80084b1b2bd685eba1ef807496627b137d87a1
SSDEEP
3072:b1xHsSP/2z15sKm0vtTBf/ZvseLmt8YnQv2Hg:DHsS2h5pmotTB5tS7Qv
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
32725a4ea69ec50c52936c2ed99ac68a_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CreateThread
GetModuleFileNameA
lstrcpynA
WinExec
MoveFileExA
GetTickCount
GetFileSize
CreateFileA
FreeConsole
GlobalMemoryStatus
GetVersionExA
GetComputerNameA
InterlockedExchange
HeapAlloc
GetProcessHeap
GetCurrentProcessId
GetCurrentThreadId
WaitForSingleObject
SetLastError
FlushFileBuffers
LCMapStringW
LCMapStringA
SetStdHandle
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
lstrcpyA
OpenProcess
TerminateProcess
CreateToolhelp32Snapshot
Process32First
Module32First
Process32Next
lstrlenA
lstrcmpiA
GetCurrentProcess
CopyFileA
lstrcatA
DeleteFileA
FindFirstFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLastError
FindNextFileA
FindClose
LoadLibraryA
Sleep
GetProcAddress
GetLogicalDriveStringsA
GetDriveTypeA
FreeLibrary
CreatePipe
CloseHandle
GetStartupInfoA
GetSystemDirectoryA
IsBadCodePtr
IsBadReadPtr
SetFilePointer
WriteFile
CreateProcessA
ReadFile
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetFileType
GetStdHandle
SetHandleCount
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
HeapSize
HeapReAlloc
SetUnhandledExceptionFilter
RtlUnwind
RaiseException
HeapFree
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
GetCommandLineA
GetVersion
GetModuleHandleA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
ExitWindowsEx
CreateWindowExA
CloseWindow
SendMessageA
keybd_event
GetSystemMetrics
SetThreadDesktop
OpenDesktopA
SetProcessWindowStation
OpenWindowStationA
mouse_event
SetCursorPos
wsprintfA
GetDesktopWindow
IsWindow
CloseWindowStation
CloseDesktop
GetProcessWindowStation
GetThreadDesktop
CreateDCA
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
BitBlt
GetDIBits
DeleteDC
DeleteObject
RegOpenKeyExA
LookupPrivilegeValueA
OpenProcessToken
SetServiceStatus
RegisterServiceCtrlHandlerA
DeleteService
CreateServiceA
RegOpenKeyA
RegQueryValueExA
RegCreateKeyA
RegSetValueExA
RegCloseKey
ControlService
OpenSCManagerA
OpenServiceA
ChangeServiceConfigA
StartServiceA
QueryServiceStatus
CloseServiceHandle
AdjustTokenPrivileges
ShellExecuteA
SHGetFileInfoA
SHDeleteKeyA
capGetDriverDescriptionA
capCreateCaptureWindowA
setsockopt
send
recv
gethostbyname
inet_addr
WSAStartup
shutdown
closesocket
connect
socket
htons
sendto
htonl
WSASocketA
Install
RundllInstall
RundllUninstall
ServiceMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ