SNCreateProcessAFun
SetDebug
SetLoin
Behavioral task
behavioral1
Sample
a15b6713d8fb1c4f32008d71ba09e764_JaffaCakes118.dll
Resource
win7-20240708-en
Target
a15b6713d8fb1c4f32008d71ba09e764_JaffaCakes118
Size
839KB
MD5
a15b6713d8fb1c4f32008d71ba09e764
SHA1
4249d42c830ee17a69ec84de53054e5e85354c5d
SHA256
cd037ef5b69b4bc8df0de87062f4e91fe599b5b7ba7aeba59c1027b8d4a0a803
SHA512
0af30f970fd7bccc426549757aa8da7d6b540e34ec7b9299cf31966ea4e9bd19a91cd088c02c641e3997a264f8955584467e9fd45453563df4c2920653c4fe37
SSDEEP
12288:l5Us29X4+MH1U07JGUJzN4523aH8LcJBXDAj0aFZPkPAAxZQ5Oek8K0WITqYG4:qIZVUIpJzhSEj0qZPkPbQzKB4
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
a15b6713d8fb1c4f32008d71ba09e764_JaffaCakes118 |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetACP
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
SetForegroundWindow
RestoreDC
GetFileTitleA
OpenPrinterA
RegQueryValueExA
PathFindFileNameA
VariantClear
ImageUnload
Netbios
InternetOpenUrlA
SNCreateProcessAFun
SetDebug
SetLoin
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ