UnHook
WSPStartup
installhook
Behavioral task
behavioral1
Sample
05a28d0ea9adf697691787690782a925_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
05a28d0ea9adf697691787690782a925_JaffaCakes118.dll
Resource
win10v2004-20240611-en
Target
05a28d0ea9adf697691787690782a925_JaffaCakes118
Size
120KB
MD5
05a28d0ea9adf697691787690782a925
SHA1
8fbcf7d028b449c6029c6a4e90ac6c186f04a762
SHA256
443a78730b22ab396c76b9f00f9b3bdb06fbe5b0f348838be09f781d848f7c64
SHA512
504b20164c7466f75476186f20366475492a23d47fa1e0d13ce2a057ddcfde686a5e2f3ca1c9a02a8b4da2be421cfc1d96e7376661149c8f9b2d508f76d12f69
SSDEEP
1536:LOCsLjfJnMqNocbMtbn8LX/pdfdWUfrfCQ0TlEgU5kTwwF3k5/E+xLAboQL6:Rsn5+qVdWyyUR51x8/L6
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
05a28d0ea9adf697691787690782a925_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LoadLibraryA
GetProcAddress
ExitProcess
UnHook
WSPStartup
installhook
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ