Begin
InstallHook
MainMonitor
init
init_FXRun
init_FXSetup
init_KWRun
init_KWSetup
init_PPRun
init_PPSetup
init_ZMRun
init_ZMSetup
Behavioral task
behavioral1
Sample
485d24c4193f6ce9aed17b546062df5f_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
485d24c4193f6ce9aed17b546062df5f_JaffaCakes118.dll
Resource
win10v2004-20240704-en
Target
485d24c4193f6ce9aed17b546062df5f_JaffaCakes118
Size
64KB
MD5
485d24c4193f6ce9aed17b546062df5f
SHA1
0c17d4e168650735297a6a44209b1565e98a4848
SHA256
123827925d2fbe7d8264b8ce64aeb0ead233346c37c49e8396176b71fd0b4136
SHA512
077729eb4e49b2f649fd778af828d46e962d7ae60ec2ee4621a466e42439843ceb2bd94b956baf570a58ced40a7c0063c35d3a81e3b4235baec89bbf31bcdfbc
SSDEEP
1536:RpU7X3/RNVBNLDbv3suXMFEhj/4XCDPPoqfO0oWH:A5NVzLcuXMFYj/4XmPPoJ0oWH
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
485d24c4193f6ce9aed17b546062df5f_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CreateProcessW
CloseHandle
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentProcess
CreateRemoteThread
GetModuleHandleW
VirtualAllocEx
WritePrivateProfileStringW
MoveFileW
GetPrivateProfileIntW
GetPrivateProfileStringW
DeleteFileW
FindClose
SetFileAttributesW
FindFirstFileW
GetFileSize
CreateFileW
ResumeThread
MultiByteToWideChar
WideCharToMultiByte
GetExitCodeThread
ExitThread
GetSystemTime
ReadFile
SetFilePointer
GetCommandLineW
OpenProcess
FlushFileBuffers
GetStringTypeW
GetStringTypeA
RtlUnwind
SetStdHandle
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
HeapReAlloc
VirtualAlloc
WriteFile
VirtualFree
HeapCreate
HeapDestroy
VirtualProtectEx
WriteProcessMemory
Sleep
LoadLibraryW
GetProcAddress
GetCurrentProcessId
GetSystemDirectoryW
TerminateProcess
GetEnvironmentStringsW
GetEnvironmentStrings
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetModuleHandleA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
VirtualProtect
GetWindowThreadProcessId
GetSystemMetrics
ShowWindow
GetClassNameW
GetWindowLongW
GetWindowTextW
DestroyWindow
FindWindowW
GetDlgItem
PostMessageW
GetParent
SetForegroundWindow
SetCapture
SendMessageW
EnumChildWindows
EnumWindows
WaitForInputIdle
MoveWindow
gethostname
gethostbyname
WSAStartup
URLDownloadToFileW
Netbios
waveOutGetVolume
waveOutSetVolume
OpenProcessToken
RegDeleteKeyW
RegEnumValueW
RegCreateKeyW
RegOpenKeyExW
RegSetValueExW
LookupPrivilegeValueW
AdjustTokenPrivileges
SHGetSpecialFolderPathW
Begin
InstallHook
MainMonitor
init
init_FXRun
init_FXSetup
init_KWRun
init_KWSetup
init_PPRun
init_PPSetup
init_ZMRun
init_ZMSetup
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ