??0smss@@QAE@XZ
??1smss@@QAE@XZ
??4smss@@QAEAAV0@ABV0@@Z
?rsacnReslut@@YAXXZ
scanMiddle
scanbegin
Behavioral task
behavioral1
Sample
JaffaCakes118_8acf5fab7c2f0a4cdd9ca6779d301687.dll
Resource
win7-20240903-en
Target
JaffaCakes118_8acf5fab7c2f0a4cdd9ca6779d301687
Size
532KB
MD5
8acf5fab7c2f0a4cdd9ca6779d301687
SHA1
aa019cad7991065f33ad272a18937c026ff69a07
SHA256
9cf6ceb1b648bcc404201d1f4d69a16bea52f8083f5bda43fbf0442ff85f778d
SHA512
974bde194dd990661b0608198254676442779d98a35fb39d4b17eaa11212725426a9bcff98404c272489b73af9895d8a49f4d270e86fabe8e0f0d8880d6af39a
SSDEEP
12288:7lhji6zuyUD3XCgI6Cm9TrlRppICzpuCjpQ9OVP9KmlW:7lhmCuyk3XZRoC8CYON9fM
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
JaffaCakes118_8acf5fab7c2f0a4cdd9ca6779d301687 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
StrRetToBufA
CoCreateInstance
SHGetMalloc
FindNextFileW
GetModuleHandleA
GetProcAddress
VirtualProtect
?uncaught_exception@std@@YA_NXZ
_vsnprintf_s
WSAAsyncSelect
FindWindowA
RegQueryValueExA
??0smss@@QAE@XZ
??1smss@@QAE@XZ
??4smss@@QAEAAV0@ABV0@@Z
?rsacnReslut@@YAXXZ
scanMiddle
scanbegin
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ