RunDllHostCallBack
����CALL
�����
�Զ�������
Static task
static1
Behavioral task
behavioral1
Sample
5e823a6c6449311ac9614a95aa5690b4_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5e823a6c6449311ac9614a95aa5690b4_JaffaCakes118.dll
Resource
win10v2004-20240704-en
Target
5e823a6c6449311ac9614a95aa5690b4_JaffaCakes118
Size
717KB
MD5
5e823a6c6449311ac9614a95aa5690b4
SHA1
218e82fd87dc6cc91d40107e173b99a96fc06ef9
SHA256
194dfdff26c63846be4b12cb29864ac46630474588ad6502b006b1e7e7ca7b41
SHA512
11770b4485141e8baa4dbd1097f34b485deab6ed315dcbc7c7b009d99076ca95d1c6dde5845ec8832de1ed33b8cc9bf5f5e539c311480043abf2013889943f3e
SSDEEP
12288:544+vhcoP0U0C8mUux7c7l7D6V1HH2TpCTB7F9g8SYNmdIkK64sK/fVba:a4+vhlN0Xc7A7uHGkTC8/kK6431ba
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
Checks for missing Authenticode signature.
resource |
---|
5e823a6c6449311ac9614a95aa5690b4_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetProcAddress
GetModuleHandleA
LoadLibraryA
ExitProcess
MessageBoxA
RunDllHostCallBack
����CALL
�����
�Զ�������
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE