TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Behavioral task
behavioral1
Sample
95e456ed618ff595cb363a38c07f50fa_JaffaCakes118.dll
Resource
win7-20240729-en
Target
95e456ed618ff595cb363a38c07f50fa_JaffaCakes118
Size
8.1MB
MD5
95e456ed618ff595cb363a38c07f50fa
SHA1
1b84d9ea046a58dad90b135f27c3b3cfd0acc664
SHA256
c6b2946cd37de16c08f79e52afc6637c53a58047b36f152666293c6d29fa150f
SHA512
6b65432a827670c19d62c399bdb9b2c308464bfd7387fae641dfae759f367636cff5853b51d8a8d9b5d7e77e4d92b83ccdbf46fd607b8c4355b2321fb7b3ab61
SSDEEP
196608:ueYUzM8s8i/QwbXI2ArdRniEA8c3tG8xKt18im1lIo7:ueYUG8i4wArl6M8Mj+n
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
95e456ed618ff595cb363a38c07f50fa_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DocumentPropertiesW
ChooseColorW
ImageList_GetImageInfo
ExtractIconW
CopyImage
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
GetFileVersionInfoSizeW
GetErrorInfo
RegSetValueExW
NetWkstaGetInfo
strncpy
GetVersion
GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
gethostbyaddr
BASS_Init
IsEqualGUID
GdiplusShutdown
AddFontMemResourceEx
WTSSendMessageW
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ