DoLeiMing
DoMainWork
ServiceMain
Behavioral task
behavioral1
Sample
76b8f85ea940649162f52f865e938896_JaffaCakes118.dll
Resource
win7-20240708-en
Target
76b8f85ea940649162f52f865e938896_JaffaCakes118
Size
171KB
MD5
76b8f85ea940649162f52f865e938896
SHA1
af23fafd3530edbc243a370f5fbecc186691060a
SHA256
c88a07ad9fa336736de9e436abaed2d1780a5ec6e84167222d0f78aa4798e1c3
SHA512
205622115b4e4e91e30d21f5ca86b1ae317221c71f4bfe6a7ae26b6f8309c8ba5c3260e4b16ab0f68b09f8ed3bbca9b1ea6319909d5b651dd9443bcd6f44e396
SSDEEP
3072:Jydiah0J2C4Iz+17nwYDIaEar04FD8SPZyF83C9A97ki6fau2awmJB/:8dQ9fO7wYDI/uFDnkOsHwmJB/
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
76b8f85ea940649162f52f865e938896_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
ExitWindowsEx
MessageBoxA
DeleteObject
RegCloseKey
ShellExecuteA
CreateStreamOnHGlobal
listen
StrCmpW
GetModuleFileNameExA
ImmReleaseContext
capCreateCaptureWindowA
waveInUnprepareHeader
malloc
lstrcatW
LoadLibraryA
VirtualProtect
GetModuleFileNameA
DoLeiMing
DoMainWork
ServiceMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ