VMP�������ǽ�β
VMP�������ǿ�ʼ
wuyul
����
Behavioral task
behavioral1
Sample
5a67da6d6728393921892b75e8ecfb16_JaffaCakes118.dll
Resource
win7-20240708-en
Target
5a67da6d6728393921892b75e8ecfb16_JaffaCakes118
Size
1.0MB
MD5
5a67da6d6728393921892b75e8ecfb16
SHA1
0f1466ddd0c79c47b950af3e3e76ee092c18f393
SHA256
b0411cbc3335708d98ead49504cc1f4c0554da275bbdf51c869b4c2652cf7ca8
SHA512
21cbd68ab9cb32bb792120074105f56f2501c729eadca23193a454ec4b3cc505736ab63f9f8f400988e9a06b17603398ac0df7f47215bc3fa95708de2a64dc3c
SSDEEP
24576:hfYIztABddoRA050CH1BqEiKCFlpiieXRGgodXOP6jsv:KI5ALdeP6CH1gTKQlMieBlodXL2
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
5a67da6d6728393921892b75e8ecfb16_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
midiStreamRestart
WSAAsyncSelect
GetVersion
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
ModifyMenuA
MessageBoxA
SetViewportOrgEx
OpenPrinterA
RegOpenKeyExA
Shell_NotifyIconA
OleInitialize
LoadTypeLi
ImageList_GetImageInfo
GetSaveFileNameA
VMP�������ǽ�β
VMP�������ǿ�ʼ
wuyul
����
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ