?��?��
GFDTRDSRTU
Behavioral task
behavioral1
Sample
062c5c83c06bf1654e6e78323b365d57_JaffaCakes118.dll
Resource
win7-20240903-en
Target
062c5c83c06bf1654e6e78323b365d57_JaffaCakes118
Size
820KB
MD5
062c5c83c06bf1654e6e78323b365d57
SHA1
ed916b89b6b293fd7a5a3a77c47d41b2c9f8ceb3
SHA256
582d216ba941ad13184a9087be26aca3149fefdcca576ae3106a68a1b78e6b2b
SHA512
64d48b26d0195f5c65abbd1c8309fc8880f8797a829192680a2cbe7ce23b233dd8cc2a5128cfacccb8be54cffea9c36918358700d15f57b4797e1758f4539020
SSDEEP
12288:fT2s19k9HwOXRCtN13ItEoxDc1/V8UipcZHXivrMaSUW1:fT2imHwOBC1oNJc1N1kc9STMD1
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
062c5c83c06bf1654e6e78323b365d57_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
waveOutUnprepareHeader
recv
TlsAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
SetMenu
SetViewportOrgEx
DocumentPropertiesA
RegSetValueExA
SHGetSpecialFolderPathA
OleUninitialize
LoadTypeLi
ImageList_Destroy
GetOpenFileNameA
?��?��
GFDTRDSRTU
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ