DoLeiMing
DoMainWork
ServiceMain
Behavioral task
behavioral1
Sample
71d84d9db1d83998700d87487af7485d_JaffaCakes118.dll
Resource
win7-20240705-en
Target
71d84d9db1d83998700d87487af7485d_JaffaCakes118
Size
171KB
MD5
71d84d9db1d83998700d87487af7485d
SHA1
8f17f0af9132d08c24ca0a5b6274999070fe3c56
SHA256
054b5d2459ad827f389ecc3be33135e4a2342564a3e395c19609bd3af1c8db04
SHA512
33b680737446d83bca7ca4fbdbc83065f7443b26d1f7d7b6116f7af0eae0b7f3273ecd8688af21a86e88c246c19c074bdc7ad4daf186a1155cc1ee9cce3de273
SSDEEP
3072:Jydiah0J2C4Iz+17nwYDIaEar04FD8SPZyF83C9A97ki6fau2awmJBt:8dQ9fO7wYDI/uFDnkOsHwmJBt
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
71d84d9db1d83998700d87487af7485d_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
ExitWindowsEx
MessageBoxA
DeleteObject
RegCloseKey
ShellExecuteA
CreateStreamOnHGlobal
listen
StrCmpW
GetModuleFileNameExA
ImmReleaseContext
capCreateCaptureWindowA
waveInUnprepareHeader
malloc
lstrcatW
LoadLibraryA
VirtualProtect
GetModuleFileNameA
DoLeiMing
DoMainWork
ServiceMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ