1|?�¨�y��?
?a?��
RunDllHostCallBack
_?���̨�??
_��?����3��D��?a��?
Behavioral task
behavioral1
Sample
b63fa0bfeef7d2dc10fa6a458c985a79_JaffaCakes118.dll
Resource
win7-20240704-en
Target
b63fa0bfeef7d2dc10fa6a458c985a79_JaffaCakes118
Size
836KB
MD5
b63fa0bfeef7d2dc10fa6a458c985a79
SHA1
53414cb1332202c545a8b5d7dded6bc3fdea8cad
SHA256
4503ac77c25fe17578ef5061c4101d1de9333caa9eb23f821d4305ed329e6f25
SHA512
64d310423e80f80965821a04375897f1268d8cef0a9ca840f8a38000a308c6d0d0eb24a60a172c6b685b4fb1c57284de169eadaf6e10c30ff90ab94d649c0f62
SSDEEP
24576:JqESle3u3c0jdSqd8PNpjRXLs82uh5fsnAuk:cES03u3rAqWPNRpY8zh5EAv
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
b63fa0bfeef7d2dc10fa6a458c985a79_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
midiStreamRestart
getpeername
MultiByteToWideChar
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
SetActiveWindow
CreatePen
OpenPrinterA
RegDeleteKeyA
ShellExecuteA
CLSIDFromString
RegisterTypeLi
ord17
GetOpenFileNameA
1|?�¨�y��?
?a?��
RunDllHostCallBack
_?���̨�??
_��?����3��D��?a��?
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ