hook
hqjb
Behavioral task
behavioral1
Sample
accd8b3254f6bd748cbb613a38ff947b_JaffaCakes118.dll
Resource
win7-20240704-en
Target
accd8b3254f6bd748cbb613a38ff947b_JaffaCakes118
Size
222KB
MD5
accd8b3254f6bd748cbb613a38ff947b
SHA1
354e8e8875476c878eb753c3645f447c0cc27930
SHA256
42fbde2bc924f618e582aa725974e6393d699ee395bbc47a2adf38318039b3f1
SHA512
7d7aeec3a7744a0d4b802e7978e022c3127c4fb1b87f3d92a40e817beaa020c1bcf052e3c855462ab39597925d578277080b4c2c555177356624db8dfec630e2
SSDEEP
6144:cNgMWOtid8QSeZXvvO8zjgYhRlWZTD/ENQSrO:cN/WOgd8XeZvvvzjgY3lQMNQSr
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
accd8b3254f6bd748cbb613a38ff947b_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
MessageBoxA
MessageBoxA
FreeLibrary
lstrcatA
GetModuleFileNameA
ExitProcess
LoadLibraryA
GetProcAddress
lstrlenA
VirtualProtect
GetModuleFileNameA
ExitProcess
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
hook
hqjb
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ