Chord
������ʱ��
Behavioral task
behavioral1
Sample
0ba2123cd0c7f0e3d056550caaff8861_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0ba2123cd0c7f0e3d056550caaff8861_JaffaCakes118.dll
Resource
win10v2004-20240611-en
Target
0ba2123cd0c7f0e3d056550caaff8861_JaffaCakes118
Size
65KB
MD5
0ba2123cd0c7f0e3d056550caaff8861
SHA1
8cd22678459dceda7727e495c4f714b4e2747224
SHA256
58e0d54a3c10f83b52752553ab29d805b3512fb6b31d41357a34a8c73a7e1edd
SHA512
2f677efe6fdb094e46cc45726921c7c7bced9ce839c517f45ccef79d6280db20180b026a429b391c11a463d87da97d6d03e96c3e220faae965a2666f239f9dc1
SSDEEP
1536:Mse3pX2B4Pl0gGThEK6q1VL3VmO3jZzraBP40YhKFIn2FUhzs:A5X26Pl0gGdlNLzV3jdraBQ027Vh
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
0ba2123cd0c7f0e3d056550caaff8861_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
MessageBoxA
MessageBoxA
GetProcAddress
GetModuleHandleA
LoadLibraryA
VirtualAlloc
GetModuleFileNameA
ExitProcess
RegQueryValueExA
Chord
������ʱ��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ