RunDllHostCallBack
_����1_��������
Behavioral task
behavioral1
Sample
d73d1fb8412e3980f9e543a94f4aaf3d_JaffaCakes118.dll
Resource
win7-20240903-en
Target
d73d1fb8412e3980f9e543a94f4aaf3d_JaffaCakes118
Size
820KB
MD5
d73d1fb8412e3980f9e543a94f4aaf3d
SHA1
260c8d7270868329ef88db6ecbc3c9d26057bead
SHA256
017266ee61d72f89529bd15ccadb79dd17ecc345de00e84ea7d00cc809324cac
SHA512
9422b6aba8cd501047ce644417b7a6aa4991caa77357b9f6913a8672570cea225dd0de4a9064ce5aa4bf9be43b52c60c5ba46e9867550ac760dae1ad963f5ebf
SSDEEP
12288:AYX8ZJJBUXv/TGNX5fvGVz8uVFS+G2XMesl3v/wcmZKL8pLCq12In+c5dqfXhoCf:AYX8rJeG+quVwp2Xa3v16mqF+c5qoC3
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
d73d1fb8412e3980f9e543a94f4aaf3d_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CreateEventA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
wsprintfA
MessageBoxA
SetPolyFillMode
waveOutUnprepareHeader
ClosePrinter
RegOpenKeyA
Shell_NotifyIconA
CLSIDFromProgID
VariantClear
ImageList_Destroy
accept
GetFileTitleA
RunDllHostCallBack
_����1_��������
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ