ZtlTaskMemAllocImp
ZtlTaskMemFreeImp
ZtlTaskMemReallocImp
Behavioral task
behavioral1
Sample
d6ac4f52ad41f473bd49a68319baca64_JaffaCakes118.exe
Resource
win7-20240729-en
Target
d6ac4f52ad41f473bd49a68319baca64_JaffaCakes118
Size
7.6MB
MD5
d6ac4f52ad41f473bd49a68319baca64
SHA1
e9d7164168e6820b6973e99781f6427fe1458a40
SHA256
dcd875e006c7bf99776342e608f3047a9c1ffb94dfc2c420728d75025c62c146
SHA512
303392466f68bb3fe67b40b6457021de326859159814b159edf255c7da55650d7edd9c4c994e7b6f4edfb4aa248612234fac4b4f3a11b2cc8d8cf632f96256af
SSDEEP
98304:DoN79TYGsD62USHaQUtq3pFCyUIuBhdtal8WGrfXsuwb:Ds7pYGrd3tlrhSarPs
resource | yara_rule |
---|---|
sample | themida |
Checks for missing Authenticode signature.
resource |
---|
d6ac4f52ad41f473bd49a68319baca64_JaffaCakes118 |
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
ZtlTaskMemAllocImp
ZtlTaskMemFreeImp
ZtlTaskMemReallocImp
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE