InstallHook
UnInstallHook
Behavioral task
behavioral1
Sample
bff821e3564c7bd0e12aaf43d41ff298_JaffaCakes118.dll
Resource
win7-20240708-en
Target
bff821e3564c7bd0e12aaf43d41ff298_JaffaCakes118
Size
328KB
MD5
bff821e3564c7bd0e12aaf43d41ff298
SHA1
fc5df7208b9640f97a4ce1db791e3d7d524226a6
SHA256
14a540e5478df39c122eb443d0ad9b4233b19cbbbf302431e326a1c171b2e558
SHA512
631625ef7f108151f296debbd6717fc3ffe13ca915a81bf98dfa16a2a35873d6e6ca14d81b0981da61392164ac8d1c4c5f0336d7d8b13fa06b003b698163a987
SSDEEP
6144:fisHj9OiV/Z9NLiAPj3EBNuGKoZ+Ca0tcaJwM+LeYuZ1Ix/v1R6uaku:T0iRVLiAPj3g0poZ+Cag3z+69q/tRIk
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
bff821e3564c7bd0e12aaf43d41ff298_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
TlsFree
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
ShowWindow
GetObjectA
DocumentPropertiesA
RegCloseKey
ord17
InstallHook
UnInstallHook
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ