ZtlTaskMemAllocImp
ZtlTaskMemFreeImp
ZtlTaskMemReallocImp
Behavioral task
behavioral1
Sample
37c0878439eebea299907ef483ac4feb_JaffaCakes118.exe
Resource
win7-20240903-en
Target
37c0878439eebea299907ef483ac4feb_JaffaCakes118
Size
7.5MB
MD5
37c0878439eebea299907ef483ac4feb
SHA1
148b61d0c24aee19e1c6fd0413f4c0676090e5f5
SHA256
669d8f3c00044104490eecad9b9daefdad95a76f722d6ce7e8eaff69d5eae344
SHA512
5195d7af2e0f0dfbd9b85445869decf7bc732f4fdb573191b71b66cfed56003cb46f183c6ccaa3bd780e0ed7a50f6007f802314e54c1127a6b6122aa15ea66ad
SSDEEP
98304:5Qttsby/VhoxNCsLYrlwLEhbyjU1ydeeA0cGPm9vfVPJrDP6C:5utVVhqC5mEhpI6xrz6
resource | yara_rule |
---|---|
sample | themida |
Checks for missing Authenticode signature.
resource |
---|
37c0878439eebea299907ef483ac4feb_JaffaCakes118 |
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
ZtlTaskMemAllocImp
ZtlTaskMemFreeImp
ZtlTaskMemReallocImp
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE