SNCreateProcessAFun
SetDebug
SetLoin
Behavioral task
behavioral1
Sample
b20f41672e87cd2aeadc7894cdb095be_JaffaCakes118.dll
Resource
win7-20240704-en
Target
b20f41672e87cd2aeadc7894cdb095be_JaffaCakes118
Size
865KB
MD5
b20f41672e87cd2aeadc7894cdb095be
SHA1
ec448ea7b69ce2a1bd6b1ccee11bf3000a3a473d
SHA256
04163b05b282572abbdd7f9a518e6790422348ff6cf50aef4926adcdebf29062
SHA512
6ce06cbd2690d24de939d367717c05307217d48b2a254e6679524bc16ce177f0424bfbf7ca397386d2d3eeb04dc3594aaa4a609be0df7e995cff2bb22a95f763
SSDEEP
12288:J5Us2ZnViR1a0d6bCyaceeNj8xFMHyVrGcoSX8sLcL0Om5OTGxnl9H8a3hWy:SVQ1NcuyfrMiSISncL0OrTGxnl5Lf
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
b20f41672e87cd2aeadc7894cdb095be_JaffaCakes118 |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetConsoleMode
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
GetWindowLongA
SaveDC
GetFileTitleA
DocumentPropertiesA
LookupPrivilegeValueA
PathFindExtensionA
VariantChangeType
ImageLoad
Netbios
InternetReadFile
SNCreateProcessAFun
SetDebug
SetLoin
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ