??0smss@@QAE@XZ
??1smss@@QAE@XZ
??4smss@@QAEAAV0@ABV0@@Z
?rsacnReslut@@YAXXZ
scanMiddle
scanbegin
Behavioral task
behavioral1
Sample
03e3efc8f4c8672e33e4a4e6f708687f_JaffaCakes118.dll
Resource
win7-20240903-en
Target
03e3efc8f4c8672e33e4a4e6f708687f_JaffaCakes118
Size
532KB
MD5
03e3efc8f4c8672e33e4a4e6f708687f
SHA1
355bf6490fd59d0fc8c398eb5cc338f7b599287d
SHA256
88d4329a41623deb7fe25d6009e3a0405897272bd676eeda32ec5b5fb648dd6e
SHA512
e973c435214ed9d5b0f1aff91b24d53803ab412bb5f2bf2af135608089e3e591adae1ad02abc5df1cf55e226b3524563bcbdf88d1dddd3677f080e127c564d46
SSDEEP
12288:7lhji6zuyUD3XCgI6Cm9TrlRppICzpuCjpQ9OVP9KmlW:7lhmCuyk3XZRoC8CYON9fc
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
03e3efc8f4c8672e33e4a4e6f708687f_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
StrRetToBufA
CoCreateInstance
SHGetMalloc
FindNextFileW
GetModuleHandleA
GetProcAddress
VirtualProtect
?uncaught_exception@std@@YA_NXZ
_vsnprintf_s
WSAAsyncSelect
FindWindowA
RegQueryValueExA
??0smss@@QAE@XZ
??1smss@@QAE@XZ
??4smss@@QAEAAV0@ABV0@@Z
?rsacnReslut@@YAXXZ
scanMiddle
scanbegin
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ