Client
sock
Behavioral task
behavioral1
Sample
e22cd69f531ac13addc016ef112694d1_JaffaCakes118.dll
Resource
win7-20240903-en
Target
e22cd69f531ac13addc016ef112694d1_JaffaCakes118
Size
39KB
MD5
e22cd69f531ac13addc016ef112694d1
SHA1
473843a28db650577dc359b98c04546a881dbf49
SHA256
455823fa7a19201d9bf75782cf6e5ffc5f583d9fc5d5f1019a8f7db79064e24a
SHA512
f86f0a5f3f31d1c02dee892b9dce6e1d7f1edc16daffceb3dd0ac216aea107281f82ca1636f1de0b72fb7807213b94d107e3c50082f7cfae5522e19a7b8854bb
SSDEEP
768:CnfNRcucEjXSDKcHiUWhSPx3PghN37yDai95dFu0jmHK1:CvcurjXiCUeSPxfa37yDaibjrjmq1
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
e22cd69f531ac13addc016ef112694d1_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
MessageBoxA
FreeLibrary
GetModuleHandleA
GetProcAddress
VirtualProtect
RegQueryValueExA
Client
sock
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ