DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
SendCommand
Behavioral task
behavioral1
Sample
bf9820790216b157ce19d6e9b1574e30_JaffaCakes118.dll
Resource
win7-20240708-en
Target
bf9820790216b157ce19d6e9b1574e30_JaffaCakes118
Size
438KB
MD5
bf9820790216b157ce19d6e9b1574e30
SHA1
1bd1ce9f13c7a4c8b5d424a68521c323750100b7
SHA256
e81d78b43ca73e19a5b27ffe4164740e96d39cd49c035ae72bc5ead37a7ac4db
SHA512
18011eee1b7d74a99b558e86ebc538bf65046e63c44c962f8ce258c44f73b7a694eae390e7ccb3eca71169b2f83020c3f0d29bdddb98926c1e6efc0f6121b59b
SSDEEP
12288:/889LvFivyqlgU6OeuUbnS1EGQg8SKG+sCxZozI:/X9LcpgDnkToGlIWI
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
bf9820790216b157ce19d6e9b1574e30_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PlaySoundW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
EnumWindows
MessageBoxA
ShellExecuteW
CoCreateInstance
PathAddBackslashW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
SendCommand
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ