DoMainWork
DoService
ServiceMain
Behavioral task
behavioral1
Sample
ae518370306ca3214d0c9863a5b913c4_JaffaCakes118.dll
Resource
win7-20240729-en
Target
ae518370306ca3214d0c9863a5b913c4_JaffaCakes118
Size
124KB
MD5
ae518370306ca3214d0c9863a5b913c4
SHA1
15e2c44029d5fce49870b2d7705b7015fd140065
SHA256
9178b78b3b7086a5df542bc01c7d5cbc61ea5d5947b5b335dcfbad00f799da36
SHA512
1552ddba2f8d1ecabb97fdf0102299168da4e6813dd422d545c91f4d1f4a4afa366b7976efb58de5262a1631c5d3252d574e15777ac7e24643acf0012340df45
SSDEEP
3072:24SsYLZAF/OgPeHOYFc9A4LaNj95SiVVGHZARfcLEIHLrvrl6S:TSs+ZAkg6OYe9A4LqDVwAmrvrz
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
ae518370306ca3214d0c9863a5b913c4_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
OpenDesktopA
GetDIBits
LookupPrivilegeValueA
SHFileOperationA
CreateStreamOnHGlobal
accept
StrCmpW
GetModuleFileNameExA
InternetReadFile
ImmReleaseContext
_beginthread
capGetDriverDescriptionA
waveInOpen
SetThreadPriority
GetModuleHandleA
GetProcAddress
VirtualProtect
DoMainWork
DoService
ServiceMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ