DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
JmpHookOn
Behavioral task
behavioral1
Sample
46228cf7b7c9b2ab84af5d3c514df625_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
46228cf7b7c9b2ab84af5d3c514df625_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
46228cf7b7c9b2ab84af5d3c514df625_JaffaCakes118
Size
88KB
MD5
46228cf7b7c9b2ab84af5d3c514df625
SHA1
06d7caa0a2b639c2385228748c8187dc4f15b984
SHA256
2dbc9bd64070b5edb88bcb63a2e0b6da4ccc1444ad9dcdbaad5169fd86f43b6c
SHA512
f7ffa916d83f5e81ee28f33aac281dd7136d61cb60f9d27fc19f4cce13a71c2f7c8008e7117b1fe4cab7a3fed1f4c33a39b33e74b6c1f49c39a5029b12ee37e5
SSDEEP
1536:M9qSQ4pmwgv3KXG3lHDFnK1zRZ8mHz+on5FxB3wbBDU4Skmsh78RM05:cTmD4ejFK1zRZ8zW5MB1Rfh7eM05
resource | yara_rule |
---|---|
sample | modiloader_stage2 |
Checks for missing Authenticode signature.
resource |
---|
46228cf7b7c9b2ab84af5d3c514df625_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
JmpHookOn
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ