LoadUnhookDriver
UnloadUnhookDriver
Behavioral task
behavioral1
Sample
3c2a29370c7978259826d522d09077b8_JaffaCakes118.dll
Resource
win7-20240903-en
Target
3c2a29370c7978259826d522d09077b8_JaffaCakes118
Size
151KB
MD5
3c2a29370c7978259826d522d09077b8
SHA1
0b9a25254363646a694df45f7ca507d193c6f3fc
SHA256
b1860ee45af066f091254483f6bd9ff6c80c32f8459226c48ffae39ccce17761
SHA512
7e563f5b9e8afeaf591ed28d37390b8ecbe0a0508563f0aef5f0bd33ac95a72e2897b98ff545dafbcf0ada638fea9707532fae5dbd76467b8e1dd199ae93fd13
SSDEEP
3072:PAJZcA0Ax4Lb7QAdZA51O7rtPnZBUB+Qdyaw3MyZKR0mKTT0i12vN2edc:PaZZ0kJADA51O7rV7UB+QkaOFmKTTX1n
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
3c2a29370c7978259826d522d09077b8_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
InterlockedDecrement
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
GetSystemMetrics
SelectObject
CloseServiceHandle
LoadUnhookDriver
UnloadUnhookDriver
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ