HookOff
HookOn
Behavioral task
behavioral1
Sample
fa0c5f3ad3f09c1fc4872d016880772c_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
fa0c5f3ad3f09c1fc4872d016880772c_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
fa0c5f3ad3f09c1fc4872d016880772c_JaffaCakes118
Size
1.4MB
MD5
fa0c5f3ad3f09c1fc4872d016880772c
SHA1
e9abed2021c9191f6c103b92206d94be0ce7d12b
SHA256
04e58fee9271dfb35493ee49f71511597df8b65ca492f10b7250c932352727d7
SHA512
600742b4ff95786cad2e91b01827de92481efbce59b9dac4ecb2816ed1be52d1b361dea6c15a5682f583f9398fa1da879fc276bdf02781a67871083dd1b053df
SSDEEP
24576:l2MuJm0sMrb8oQxQv/HcCGbwO+jbXFT0CNiTKUiT5hC4Bt/P1GCVnqu:MMu80b4pKvfcUjja3KrdhjXdV9qu
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
fa0c5f3ad3f09c1fc4872d016880772c_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
lstrcpy
InitCommonControls
HookOff
HookOn
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE