DllRegisterServer
DllUnregisterServer
PauseW
ResumeServer
ResumeW
StartServer
StartW
StopServer
StopW
SuspendServer
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
eee062f43b42bba39663fb628a7da063_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
eee062f43b42bba39663fb628a7da063_JaffaCakes118.dll
Resource
win10v2004-20240226-en
Target
eee062f43b42bba39663fb628a7da063_JaffaCakes118
Size
66KB
MD5
eee062f43b42bba39663fb628a7da063
SHA1
c349ca54ffcd54077f1215740029f909c85ccc06
SHA256
abed6d2ad917018dbd98efabc31bde51ff3cc2e4f71b60e7b8a71344a90df0d7
SHA512
19fad524b904eea8fa31f8c4cf2cda03d58e2a7e10a476896f53799b66d10291420c7ad997ffe8d829f32dcc07695b0e68dfd8f9fa8785ebc821d237b58ca12e
SSDEEP
1536:Rq8PQsGtzp/dsSTnOuhBRMRSuAM4yxSZ9:RqZsGP/awZhBRKH
bazarloader
164.90.198.79
164.90.198.77
blackrain15.bazar
bluehail.bazar
resource | yara_rule |
---|---|
sample | BazarLoaderVar6 |
Checks for missing Authenticode signature.
resource |
---|
eee062f43b42bba39663fb628a7da063_JaffaCakes118 |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
StrCSpnA
StrCSpnW
StrSpnA
StrSpnW
HeapReAlloc
GetProcAddress
GetModuleHandleA
ExitProcess
lstrcatW
HeapFree
lstrlenW
lstrlenA
HeapAlloc
GetProcessHeap
lstrcpyW
lstrcpyA
lstrcatA
lstrcpynW
lstrcmpA
wsprintfA
wsprintfW
DllRegisterServer
DllUnregisterServer
PauseW
ResumeServer
ResumeW
StartServer
StartW
StopServer
StopW
SuspendServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ