RunDllHostCallBack
������
����
������������
���������
����
�ٻ�CALL
�Զ��幥��
Behavioral task
behavioral1
Sample
414e95d26714f3d506b9e337667e5d4b_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
414e95d26714f3d506b9e337667e5d4b_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
414e95d26714f3d506b9e337667e5d4b_JaffaCakes118
Size
712KB
MD5
414e95d26714f3d506b9e337667e5d4b
SHA1
b962a97cc12aee60ef7779d48259ac5a2f6ca1bb
SHA256
5fd8c5fc64ad5a8a2758ee488eb2ae2b8d715918df9c2f46d7d475f7d35b7e29
SHA512
f6f3eac186aad44f524847af75c046b9e203cf554f21ed6df8e8adfd4818a7a9ae385c7a9c96654a3f4eee7119b4b2d6c72f87e8b0393ca633d16d0f8e6d87cf
SSDEEP
12288:dIRdSa5C2Ch5DYVuGId0+UsUzS4EGYkcYl6fHwFxON3zcudvYiWcJecyd5M:dI/juSuGINg6/wFxONDjYfaE5M
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
414e95d26714f3d506b9e337667e5d4b_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
midiStreamRestart
WSAAsyncSelect
MultiByteToWideChar
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
EnumDisplaySettingsA
MessageBoxA
GetClipBox
OpenPrinterA
RegOpenKeyExA
ShellExecuteA
OleInitialize
LoadTypeLi
ord17
GetSaveFileNameA
RunDllHostCallBack
������
����
������������
���������
����
�ٻ�CALL
�Զ��幥��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ