DoMainWork
DoService
ServiceMain
Behavioral task
behavioral1
Sample
60b0144a85f7cea27b1b7dce963f52ff_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
60b0144a85f7cea27b1b7dce963f52ff_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
60b0144a85f7cea27b1b7dce963f52ff_JaffaCakes118
Size
132KB
MD5
60b0144a85f7cea27b1b7dce963f52ff
SHA1
102bd62423f88364ed8b6d628d516ebd7dc60ffa
SHA256
8b96403d2824d8607d3e85e2773b826348add4181ce688908b1dc93d52a7e72e
SHA512
476f2bc21e73184fe857ecee4b7003840a9aa28f2f3271241a01e80c431980d306abd3c4dde1d6d5d67d73be2950b22c770f479f07be7fd6c22dcf1e049a0adf
SSDEEP
3072:LjA6R/+KMRkSwPNOlIPnHV99nwdxo60wDMg3DspTvdtG+:zZMu3sSpnsozwJ3D2TlU+
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
60b0144a85f7cea27b1b7dce963f52ff_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
ExitWindowsEx
DeleteObject
RegCloseKey
ShellExecuteA
CreateStreamOnHGlobal
listen
StrCmpW
GetModuleFileNameExA
ImmReleaseContext
capCreateCaptureWindowA
waveInUnprepareHeader
malloc
lstrcatW
GetModuleHandleA
GetProcAddress
VirtualProtect
DoMainWork
DoService
ServiceMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ