RunDllHostCallBack
��??��1???
Behavioral task
behavioral1
Sample
2c460a43bd90db50f1488dc2d2d9c74c_JaffaCakes118.dll
Resource
win7-20240903-en
Target
2c460a43bd90db50f1488dc2d2d9c74c_JaffaCakes118
Size
972KB
MD5
2c460a43bd90db50f1488dc2d2d9c74c
SHA1
1e806fe1732361cb9d7886df68d1dd0a858ffd3d
SHA256
7603541e437d82d48019cfecf24344ea8125294a14ae66db469d47b44f9a842b
SHA512
9e9403ea3e0d84197fc9fb9d673eb5a9d52b8d6b5171f942758450c5932ea82bac0675233651bd857238836739401402b93c87bc1909087af9d5e9c9ce6b1e08
SSDEEP
24576:hiAKbke+iZ9tJT4oKC13hdQ853vKeTBd8yh/:neVHtJThKC1xK85fKeP8yh
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
2c460a43bd90db50f1488dc2d2d9c74c_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
midiStreamClose
ioctlsocket
CompareStringW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
InflateRect
LPtoDP
ClosePrinter
RegQueryValueA
ShellExecuteA
OleInitialize
RegisterTypeLi
ImageList_Destroy
GetFileTitleA
RunDllHostCallBack
��??��1???
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ