Hookoff
Hookon
InstallService
KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode
Behavioral task
behavioral1
Sample
b162c0c10072d09fb9f4b5e7c05a2d23_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b162c0c10072d09fb9f4b5e7c05a2d23_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
b162c0c10072d09fb9f4b5e7c05a2d23_JaffaCakes118
Size
43KB
MD5
b162c0c10072d09fb9f4b5e7c05a2d23
SHA1
52b9d46328e851d5abfe8214ae190aaff8e80d9b
SHA256
98b22374c62038db9465e709a11d8145cfff8517ec1027d448e6aea52c8f3e96
SHA512
d9fc811564f8c34edd6c17bc329758ab352c342e5bb586c292c7398cca61cf1969756d63960efdb882a739bbb594f4e0bea7a15c6f8a477dabf3450ec4186efe
SSDEEP
768:6MCmtAVbBQblG/w8ODTVLw+fbC/3PG3Olo9BwaMJTFh9HAR:TEQbj8OhfbC//gOl0BwFv9gR
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
b162c0c10072d09fb9f4b5e7c05a2d23_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
MultiByteToWideChar
GlobalFree
GlobalUnlock
WriteFile
GlobalLock
GlobalAlloc
GetTempPathA
Process32Next
Process32First
CreateToolhelp32Snapshot
IsBadReadPtr
WideCharToMultiByte
GetCommandLineA
lstrcpyW
lstrlenW
CreateThread
DeleteFileA
GetModuleHandleA
SetFilePointer
GetModuleFileNameA
Module32First
CopyFileA
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
GetLastError
CreateMutexA
CreateRemoteThread
GetCurrentProcess
VirtualProtect
CreateFileA
ReadFile
GetFileSize
CloseHandle
GetTickCount
lstrcmpiA
lstrlenA
lstrcpynA
lstrcpyA
lstrcmpA
Sleep
ExitProcess
GetSystemDirectoryA
lstrcatA
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentThreadId
OutputDebugStringA
PostThreadMessageA
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
EnumWindows
GetSystemMetrics
GetWindowTextA
IsWindowVisible
IsIconic
GetActiveWindow
ShowWindow
SetForegroundWindow
GetWindowInfo
PrintWindow
FindWindowA
FindWindowExA
GetWindowThreadProcessId
IsRectEmpty
ReleaseDC
GetDC
GetDIBits
RealizePalette
SelectPalette
GetStockObject
GetObjectA
DeleteDC
GetDeviceCaps
CreateDCA
DeleteObject
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
InternetSetOptionA
HttpAddRequestHeadersA
InternetQueryDataAvailable
InternetWriteFile
InternetReadFile
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
HttpSendRequestExA
InternetCloseHandle
InternetOpenA
HttpEndRequestA
Netbios
GdipCloneImage
GdipDisposeImage
GdipFree
GdiplusStartup
GdipAlloc
GdipLoadImageFromFile
GdipSaveImageToFile
GdiplusShutdown
GdipGetImageEncodersSize
GdipGetImageEncoders
strrchr
_except_handler3
sprintf
memmove
??2@YAPAXI@Z
wcscmp
??3@YAXPAX@Z
malloc
free
strstr
atoi
ImageNtHeader
Hookoff
Hookon
InstallService
KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ