??0CPl@@QAE@XZ
??4CPl@@QAEAAV0@ABV0@@Z
?InstallH@@YAHDDHH@Z
?fnMlangl@@YAHXZ
?init@@YAHXZ
?nMlangl@@3HA
Behavioral task
behavioral1
Sample
de2a142756343645013788832c422d3d_JaffaCakes118.dll
Resource
win7-20240903-en
Target
de2a142756343645013788832c422d3d_JaffaCakes118
Size
96KB
MD5
de2a142756343645013788832c422d3d
SHA1
5088a29b587b7c50056ea272cce03edb187bb0d8
SHA256
90a53d4bb793559bebef0984c8a7ca71e4ca149f5fce3cb3e7f62f2798145851
SHA512
81b6e4eb285a30a569f2f27d62cb1ad64fe0c0b69ba85cb8098e3ab0e41a062c7f121e8bd65f98877f28608727d9ee2bb8743c9eaf3eb80bd5b64b5d9a4abc68
SSDEEP
1536:2O8gK8TaL0dacuToZB+SLkE9PoamhrS/duMo8+kXKyOw7SIW5nRz209DzEgocL94:2IRaLojYS7m5S/duVk7OvRhggtLC7
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
de2a142756343645013788832c422d3d_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
VirtualProtectEx
GetCurrentProcess
GetCurrentProcessId
GetProcAddress
LoadLibraryA
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetLastError
CreateMutexA
GetStringTypeW
GetStringTypeA
LCMapStringW
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
MultiByteToWideChar
LCMapStringA
RtlUnwind
FindWindowA
??0CPl@@QAE@XZ
??4CPl@@QAEAAV0@ABV0@@Z
?InstallH@@YAHDDHH@Z
?fnMlangl@@YAHXZ
?init@@YAHXZ
?nMlangl@@3HA
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ