RunDllHostCallBack
asm_�������ڴ�
asm_���ֽڼ��ڴ�
asm_д�����ڴ�
����
����
ȡ��������
Static task
static1
Behavioral task
behavioral1
Sample
fdf0bc9a6a4b43b4bc15e16c050666b3_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fdf0bc9a6a4b43b4bc15e16c050666b3_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
fdf0bc9a6a4b43b4bc15e16c050666b3_JaffaCakes118
Size
1.0MB
MD5
fdf0bc9a6a4b43b4bc15e16c050666b3
SHA1
3b5f42f33aa3eb519d81854861cf9256538d915c
SHA256
0671a23b8026c2bedfe3b1298d57172ccc83366f638b7e1573cf467e375bee02
SHA512
347c3f30fe6169e2befe64cc58809e0d9144aadbf3853c5dd01a5e1813c360d7cd97562d21c314ddf312137df7c3d7e7144a094ca2bf8c2bd92ed113286d00e5
SSDEEP
12288:RPhT/nZ3GOtx5YazjCy1WNxrJKgeXnpHVM68p9cmBmVyVyhvVQj03u:RpDZ3xCAjCy1WvY/n5FKjBmVeevp3u
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
Checks for missing Authenticode signature.
resource |
---|
fdf0bc9a6a4b43b4bc15e16c050666b3_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetProcAddress
GetModuleHandleA
LoadLibraryA
ExitProcess
MessageBoxA
RunDllHostCallBack
asm_�������ڴ�
asm_���ֽڼ��ڴ�
asm_д�����ڴ�
����
����
ȡ��������
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE