TMethodImplementationIntercept
__GetExceptDLLinfo
___CPPdebugHook
dbkFCallWrapperAddr
Behavioral task
behavioral1
Sample
a42920aea27555a4248b5acfa5fabe71_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
a42920aea27555a4248b5acfa5fabe71_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Target
a42920aea27555a4248b5acfa5fabe71_JaffaCakes118
Size
11.2MB
MD5
a42920aea27555a4248b5acfa5fabe71
SHA1
e132287bc828ffc7c733f341c3d2998e9307647e
SHA256
0941d62e72678fe8d93fdb088f9ec10b2e2b6ff84d43b08bf8249e7d84c15a24
SHA512
ed38a042063d3da0bfb10f211b606ece15bb81207647316e82cdd3a0199a9b3bdbbd68ccc4d538bd664d0220cba85dfe8f82e983f02a46a567d9b81f442cb344
SSDEEP
196608:gwzurp5GsGHygXTfZkShY3zW8e9653x3d/nUoxUifM/tCdasQZ+:52yH91kgCzWsxN/Uojfqkj
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
a42920aea27555a4248b5acfa5fabe71_JaffaCakes118 |
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
WinVerifyTrust
AdjustTokenPrivileges
GetVersion
GetVersionExA
GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
NetApiBufferFree
RpcStringFreeW
GetFileVersionInfoSizeW
ClosePrinter
FlatSB_GetScrollInfo
ChooseColorW
AbortDoc
TransparentBlt
ShellExecuteExW
SHGetFolderPathA
ActivateKeyboardLayout
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
CoCreateInstance
GetErrorInfo
PathFileExistsA
GetAdaptersInfo
WinHttpAddRequestHeaders
WTSEnumerateProcessesW
WTSSendMessageW
NtOpenFile
URLDownloadToFileW
TMethodImplementationIntercept
__GetExceptDLLinfo
___CPPdebugHook
dbkFCallWrapperAddr
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ