UnHook
WSPStartup
installhook
Behavioral task
behavioral1
Sample
3df77842d3bf38dbf1ca4e880bc4e59d_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3df77842d3bf38dbf1ca4e880bc4e59d_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
3df77842d3bf38dbf1ca4e880bc4e59d_JaffaCakes118
Size
132KB
MD5
3df77842d3bf38dbf1ca4e880bc4e59d
SHA1
b9f89d1db2bb06fc12f20e5a5c3fcc042005e85d
SHA256
711de6478e4fa0b81c03b1d5e37409b82a17170e32c3ecdf90400f3b6f4d1135
SHA512
2ce602189f0f2023acb98d953cc1797e5a8d3fdefbff2f3cfc7a7319d2ebde901443429ee4d98dc873cf4d9f5a60626f9348cbd9bb0675d17652cc11113d47fd
SSDEEP
3072:wUHVUljmcV5fJAVYJR8OIZ8cnBGDQztsp:NCvTJJRRIDnIDQz2p
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
3df77842d3bf38dbf1ca4e880bc4e59d_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LoadLibraryA
GetProcAddress
ExitProcess
UnHook
WSPStartup
installhook
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ