UnHook
WSPStartup
installhook
Behavioral task
behavioral1
Sample
2ec44561115fc4a336cf577ad18407ec_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2ec44561115fc4a336cf577ad18407ec_JaffaCakes118.dll
Resource
win10v2004-20240704-en
Target
2ec44561115fc4a336cf577ad18407ec_JaffaCakes118
Size
120KB
MD5
2ec44561115fc4a336cf577ad18407ec
SHA1
c43add49481666507e3804fbfcf41b2922b9bd33
SHA256
c221b525ffc417d9a284ee1aba1e3fe1f05d93ce7db3c0c9a6ccf66c15dadc30
SHA512
50826375904fb22e44df8d4cca66fe79af462de71a6df82312fdc10b1f87454d9fbd307e0f7900f0e550398e8f648c842b006c4670e8220459eda9c8720cb086
SSDEEP
3072:RcVkFFY/2f35XZ2cCgQoFhokeRwOg1SP6jeAe:RcyFX/tZ2cjQoFhoDwO6Sz1
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
2ec44561115fc4a336cf577ad18407ec_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LoadLibraryA
GetProcAddress
ExitProcess
UnHook
WSPStartup
installhook
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ