ResetSSDT
ServiceMain
Behavioral task
behavioral1
Sample
41425bc63e5c5f8c1c27ed423ca17c49_JaffaCakes118.dll
Resource
win7-20240704-en
Target
41425bc63e5c5f8c1c27ed423ca17c49_JaffaCakes118
Size
319KB
MD5
41425bc63e5c5f8c1c27ed423ca17c49
SHA1
6a0d298b800dc534fe03075d1975babb803a2b49
SHA256
9dc2b78996c3a9d8a503fea7e9302975f5cf3ce93bc04c5f8e4443c0c0d49c20
SHA512
203a3464be3c6b0e35f2d22252b1ffbcf06895eebb12d26b144334679d856421d8245014e5e84220464ca1c50c23038be91428064ed381569d130793308dbfc0
SSDEEP
6144:v7iqvdXjlwTctvD1f+2epcnjSczeINziZuxXbsRoMA94L6p64jCJ9aJ9Vw:v7igdXxwINw2yccI8ZAVMA94L6p642Cc
resource | yara_rule |
---|---|
sample | family_gh0strat |
Checks for missing Authenticode signature.
resource |
---|
41425bc63e5c5f8c1c27ed423ca17c49_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
ResetSSDT
ServiceMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ