ServiceAV1
ServiceAV2
ServiceAV3
ServiceAV4
ServiceAV5
ServiceMain
Behavioral task
behavioral1
Sample
da04909f6c1e6b279329b22a086d70f8_JaffaCakes118.dll
Resource
win7-20240903-en
Target
da04909f6c1e6b279329b22a086d70f8_JaffaCakes118
Size
181KB
MD5
da04909f6c1e6b279329b22a086d70f8
SHA1
90b63ed60b66d60eda56b22f176eff09744d7726
SHA256
1616cfbb0abe998d9987911aa6e50c25f6623bdf5d989a63c4427a734cb662c5
SHA512
25bc3eee4b214ff6838207600ec0f2ef247c1b5324cf75eee9cfd2987f90ce9a85af5def047739c42e608bf535fa2f4420bc9ff1eb6b1beda6370a895750181f
SSDEEP
3072:SzmIbNaePWFIURIrxVtixHKNQnhPYzZ7HJCRAAobZoM56bQ1dQiu6V1vaeIz5gDY:IXxteFIZHtiUNKhA7CDjSFnfnaHzqCGy
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
da04909f6c1e6b279329b22a086d70f8_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
HeapFree
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
SetCapture
MessageBoxA
DeleteDC
LookupAccountNameA
SHGetSpecialFolderPathA
SHDeleteKeyA
_strnicmp
waveOutClose
gethostname
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
ImmReleaseContext
InternetOpenA
capGetDriverDescriptionA
ICSeqCompressFrame
GetModuleFileNameExA
WTSFreeMemory
ServiceAV1
ServiceAV2
ServiceAV3
ServiceAV4
ServiceAV5
ServiceMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ