Install
Launch
ServiceMain
UnInstall
Behavioral task
behavioral1
Sample
fc29a4b05ca5da1a1401834c987d2a67_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fc29a4b05ca5da1a1401834c987d2a67_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
fc29a4b05ca5da1a1401834c987d2a67_JaffaCakes118
Size
350KB
MD5
fc29a4b05ca5da1a1401834c987d2a67
SHA1
e89669dc136c4ea623afde574df96d2e747ec89c
SHA256
5a8b3f05226ed3a41e7f6ef5a30d9ac366576e738fcf56dffa46ed7ce997459d
SHA512
85fc19cb5a4ad71e0d44ff567bbcd24fba5c9ca9745d2f5980dc96a14c535e738b42fb1933cef08b005f84d0f3f450a3ee1c5528703f626d750aa07c03f71ac6
SSDEEP
6144:e7FBNxY+X0G/fu7/9natGfFzup5iWQxVaLKLhKUtxeKq+8pCE6NiW8d0FaIyDEHu:0FBbj0yfu7bfFqpIpV9l1/eKr8ciOQJl
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
fc29a4b05ca5da1a1401834c987d2a67_JaffaCakes118 |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
inet_ntoa
InternetOpenW
StrCmpIW
ImmGetCompositionStringW
mixerSetControlDetails
GetModuleFileNameExW
CreateEnvironmentBlock
GetModuleHandleA
GetModuleHandleA
GetProcAddress
VirtualProtect
GetKeyNameTextW
BitBlt
CreateServiceW
SHChangeNotify
CoInitialize
SysFreeString
Install
Launch
ServiceMain
UnInstall
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ