DoMainWork
DoService
ServiceMain
Behavioral task
behavioral1
Sample
00eb9715b66e44962c507f5a092c7512_JaffaCakes118.dll
Resource
win7-20240903-en
Target
00eb9715b66e44962c507f5a092c7512_JaffaCakes118
Size
145KB
MD5
00eb9715b66e44962c507f5a092c7512
SHA1
c21ee81cca9a975db3cbc14c389cb1afd232f7c3
SHA256
63747619fbb97d47ba845021db292dceed65767d782575e2f8a9997ee913722f
SHA512
41ef010375465a88c983a0f1ed3be48ef6573fb682dcb6f8356fd61a0e6c36cc2b6ac4df2b77b8374fb72faa1781a2a7ae8cfd1154dc9961322c82d2eab2492b
SSDEEP
3072:T7DkjSxHlm0YK55qjyAZCespFSfmi7eMMKNoMYHmn6:T7NxHtYK8Ynv8+MYHmn6
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
00eb9715b66e44962c507f5a092c7512_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
ExitWindowsEx
DeleteObject
RegCloseKey
ShellExecuteA
CreateStreamOnHGlobal
listen
StrCmpW
GetModuleFileNameExA
ImmReleaseContext
capCreateCaptureWindowA
waveInUnprepareHeader
malloc
lstrcatW
GetModuleHandleA
GetProcAddress
VirtualProtect
DoMainWork
DoService
ServiceMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ