ServiceMain
ServiceMainManual
Behavioral task
behavioral1
Sample
657494416038aa5d6956d94ec0c71c9d_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
657494416038aa5d6956d94ec0c71c9d_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
657494416038aa5d6956d94ec0c71c9d_JaffaCakes118
Size
480KB
MD5
657494416038aa5d6956d94ec0c71c9d
SHA1
efdfc80f177f5db22aeb7859c27fe24599bea6be
SHA256
e18bc06e33765710bac5e4a2c6463fd22d45840d8f3d93cb548467dc5bb88fda
SHA512
54a8ebaa88cbc8f4f20eab567027b5d67ae8ca65820ae80412e0d74bb2c6b912b03d29f659dc8725544820c28e39acea486bf0d6a406268122ffcacb20f759b0
SSDEEP
3072:aoytaFEYtdnuNEHKZo3pElmyEz50JGNurynaA2+6SaMS2pgBm2TK2GQJr:gaWY6N6K+GMyEz50JAPiTMsB
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
657494416038aa5d6956d94ec0c71c9d_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
VirtualFree
VirtualAlloc
ExitProcess
GetProcAddress
LoadLibraryExA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
FreeLibrary
LoadLibraryA
wsprintfA
MessageBoxA
ServiceMain
ServiceMainManual
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ