UnHook
WSPStartup
installhook
Behavioral task
behavioral1
Sample
03dbe7bf720dda8d21d926ce50570b4f_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
03dbe7bf720dda8d21d926ce50570b4f_JaffaCakes118.dll
Resource
win10v2004-20240611-en
Target
03dbe7bf720dda8d21d926ce50570b4f_JaffaCakes118
Size
132KB
MD5
03dbe7bf720dda8d21d926ce50570b4f
SHA1
ea4e7ddc201b63a7c45dc2ec7d48acfe6f2faf2a
SHA256
f502541c206b2fbf656e24490269907a6f48af20873287ae71724738544edf83
SHA512
f4633bd0be00876046878494aeaa189e5bd55f4eb8f46e5e6b112ce5718f1500cfcf436a70b329ca5dcdea24eb7db388ef955c9b6128a8b6a557fc159305d2f6
SSDEEP
1536:JnQh3+tgdF2z8tSWen1vPi9kn7tvpsVWIrYPRywEYjcJFXVUz1U/HOXUEsbBRxSe:JnQjAtn1v0kVpl1ilVUz1I0UFb5qa7
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
03dbe7bf720dda8d21d926ce50570b4f_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LoadLibraryA
GetProcAddress
ExitProcess
UnHook
WSPStartup
installhook
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ