??��??��?a��??��
??��??��?a��??��2
RunDllHostCallBack
��???���̦�??��
Behavioral task
behavioral1
Sample
6f0807ade15bc49dd5168945b4cf264c_JaffaCakes118.dll
Resource
win7-20240705-en
Target
6f0807ade15bc49dd5168945b4cf264c_JaffaCakes118
Size
944KB
MD5
6f0807ade15bc49dd5168945b4cf264c
SHA1
820c5d62a15a57b2a4b641db94247045b0a6e991
SHA256
24de4021788b889a131288e1c10e4d7f296b3a5f58e808173d9b209dd7dba850
SHA512
92713415c4fc5e4990abc16fd203c07f9613f0950f546b489b09ab131efe3e1fa5485b9487449f63682e3d0a8ac6995ddddc4382984a6a336fd0bf0cf5aa4306
SSDEEP
24576:Z0drO5rvAhZJMgr+9hZ3XwuwIwoHhyijiQ6:Z0d6xvA7JMe+9hZHwIJhyr
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
6f0807ade15bc49dd5168945b4cf264c_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
UnlockFile
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
GetTopWindow
MessageBoxA
SetWindowExtEx
midiStreamProperty
DocumentPropertiesA
RegSetValueExA
Shell_NotifyIconA
CLSIDFromString
UnRegisterTypeLi
ImageList_Destroy
accept
ChooseColorA
??��??��?a��??��
??��??��?a��??��2
RunDllHostCallBack
��???���̦�??��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ