UnHook
WSPStartup
installhook
Behavioral task
behavioral1
Sample
fcc0efaf6f8294da3dae6391747fc6c5_JaffaCakes118.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
fcc0efaf6f8294da3dae6391747fc6c5_JaffaCakes118.dll
Resource
win10v2004-20240412-en
Target
fcc0efaf6f8294da3dae6391747fc6c5_JaffaCakes118
Size
132KB
MD5
fcc0efaf6f8294da3dae6391747fc6c5
SHA1
d7e719a351065e3617731ac76d336038d529c167
SHA256
c1bc8c053f128ed058bf9623dbec472442835f22a9491d46cf6c1ad9f082be4f
SHA512
b611b8f7303961e900fcdc4b043e2e5d3472a9a3092fff2c5d58a1c3ab0821bc989f012a7a04c99a622af14a1f0a86c4b283cd835f0f7f7063d865bcf12b77a8
SSDEEP
3072:UJnaKvoc64P2l2P49cAwWsLAwluj7GVnvbdtpxNf:oJvo02l4AwfLAwdvbdtnl
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
fcc0efaf6f8294da3dae6391747fc6c5_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LoadLibraryA
GetProcAddress
ExitProcess
UnHook
WSPStartup
installhook
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ