ZtlTaskMemAllocImp
ZtlTaskMemFreeImp
ZtlTaskMemReallocImp
Behavioral task
behavioral1
Sample
3ab4089c864760a4e4e85e389aa9052a_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3ab4089c864760a4e4e85e389aa9052a_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Target
3ab4089c864760a4e4e85e389aa9052a_JaffaCakes118
Size
7.6MB
MD5
3ab4089c864760a4e4e85e389aa9052a
SHA1
35efe1c4477ce3d20d7cc0a2ccaa68e1dad95848
SHA256
f6edcf3be164c900227c87bfdf6a46c5c63afec4303ce580af97c466df5aa696
SHA512
07809de4caeacdf50e8952f39ff4c09147e43b65e3bb790885fb9228200c4650ee00df56b14e8443c4614c69b37749bee68e3669daf31e51aea307fa72016351
SSDEEP
98304:Aa4viI7CnTpZ6Y8JJf1GAnF153UlWBLaucCtWSxaXBPM:34XeTpZ6HT4WMucCgaaXF
resource | yara_rule |
---|---|
sample | themida |
Checks for missing Authenticode signature.
resource |
---|
3ab4089c864760a4e4e85e389aa9052a_JaffaCakes118 |
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
ZtlTaskMemAllocImp
ZtlTaskMemFreeImp
ZtlTaskMemReallocImp
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE