Rool
ServiceMain
whm
Behavioral task
behavioral1
Sample
4390468a5d55bfd1448bc150ce32cc9d_JaffaCakes118.dll
Resource
win7-20240708-en
Target
4390468a5d55bfd1448bc150ce32cc9d_JaffaCakes118
Size
98KB
MD5
4390468a5d55bfd1448bc150ce32cc9d
SHA1
ed217e6eb872f326f973c006aca7a36f036d443a
SHA256
5005277930dd32e49f08ac028f5f0089e32cb917d503bba7ec1d11ae182009cb
SHA512
36f3fbd6df8cc81d6dbf126a462cb14f9e9ff57a24160a6abd6ff3cdce1ff74fb508388ef1ebc9ff5e94197e7ee1bc67628195c15f05ad0991653c1f3b48d414
SSDEEP
1536:pZYgZgz+ucsAIoT8cc173DsBaxt5GchspfaFQGclbTw+3b:pZYgZgQXIowc4PEOt5GSspaFQ95Tw+3b
resource | yara_rule |
---|---|
sample | family_gh0strat |
Checks for missing Authenticode signature.
resource |
---|
4390468a5d55bfd1448bc150ce32cc9d_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Rool
ServiceMain
whm
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ