DoMainWork
DoService
ServiceMain
Behavioral task
behavioral1
Sample
47bd08584fbaf495062691a1ae9fc2b2_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
47bd08584fbaf495062691a1ae9fc2b2_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
47bd08584fbaf495062691a1ae9fc2b2_JaffaCakes118
Size
145KB
MD5
47bd08584fbaf495062691a1ae9fc2b2
SHA1
e52206c2c69578060bbedfc9f08db9980605e043
SHA256
0895282aeb466ec125af56e16f661010db9379f88ea1a5eb45742a0475557bcb
SHA512
c33db0d744322e7acdb836fc3efcf98e393b58600280197f3c063073b7aff34dd1f3c906cbfd78d43066bb015a2437adb84efd15232a5b59d9477aba298ecf47
SSDEEP
3072:T7DkjSxHlm0YK55qjyAZCespFSfmi7eMMKNoMYH5bx1N:T7NxHtYK8Ynv8+MYHtzN
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
47bd08584fbaf495062691a1ae9fc2b2_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
ExitWindowsEx
DeleteObject
RegCloseKey
ShellExecuteA
CreateStreamOnHGlobal
listen
StrCmpW
GetModuleFileNameExA
ImmReleaseContext
capCreateCaptureWindowA
waveInUnprepareHeader
malloc
lstrcatW
GetModuleHandleA
GetProcAddress
VirtualProtect
DoMainWork
DoService
ServiceMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ