guard_end
guard_start
Behavioral task
behavioral1
Sample
f6ddfc7b50d5a94d744d785158055802_JaffaCakes118.dll
Resource
win7-20240708-en
Target
f6ddfc7b50d5a94d744d785158055802_JaffaCakes118
Size
52KB
MD5
f6ddfc7b50d5a94d744d785158055802
SHA1
35a841d913ddfd4a28ed3c7d784cedb610c31886
SHA256
8c10f83c915049bdd69e6a0851ed68e356377d91a0b166f100c4cb496db6d048
SHA512
baf45212b06f665f8983dfe4b3ab3ff950ee45dcb363f8c86d096335e61707d16130ddf64810c95cbf18d4ed68e7c0b23b8f11a95afccc3953cb2dc1d1f5711a
SSDEEP
768:YbtYhE0DdcuUkOaSpqByssjnM0r2/DBWYGOxFbPrwI:Y+hE0DdhURaSMkbAWYF
resource | yara_rule |
---|---|
sample | family_blackmoon |
Checks for missing Authenticode signature.
resource |
---|
f6ddfc7b50d5a94d744d785158055802_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
_adjust_fdiv
_initterm
modf
malloc
free
strncmp
_ftol
strrchr
srand
_CIpow
strncpy
_CIfmod
??2@YAPAXI@Z
strtod
sprintf
floor
_strnicmp
??3@YAXPAX@Z
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
LCMapStringA
GetCommandLineA
CopyFileA
SetThreadPriority
LoadLibraryA
CreateThread
OpenProcess
GetVersionExA
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceFrequency
GetCurrentProcess
GetModuleHandleA
GetModuleFileNameA
CloseHandle
TerminateThread
TerminateProcess
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetCurrentDirectoryA
GetPrivateProfileStringA
WritePrivateProfileStringA
Sleep
GetTickCount
MultiByteToWideChar
WideCharToMultiByte
RegCreateKeyExA
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCloseKey
RegSetValueExA
OpenProcessToken
ZwResumeProcess
DispatchMessageA
wsprintfA
MessageBoxA
GetMessageA
PeekMessageA
TranslateMessage
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
OleRun
CoInitialize
CoUninitialize
LoadTypeLi
VarR8FromCy
VarR8FromBool
RegisterTypeLi
SafeArrayDestroy
VariantClear
SafeArrayCreate
SysAllocString
guard_end
guard_start
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE