DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
MyHookOn
Behavioral task
behavioral1
Sample
61a2c42df24f9a46ae1176c95bfab761_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
61a2c42df24f9a46ae1176c95bfab761_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
61a2c42df24f9a46ae1176c95bfab761_JaffaCakes118
Size
57KB
MD5
61a2c42df24f9a46ae1176c95bfab761
SHA1
9b75068ea982e39e0a939337a1b822f0ac25304e
SHA256
d00f3712c4c25936e646f996e4a2e66787d7a98eec71894cffd670b2b473eca5
SHA512
a6eb231330ae20d0d5886c2a5e1bd25d2e1aa77d3656b9435cef6ab1f8ef7864f48a92726a357fb3a4679b25a62419694327ff02b9e1a7797ba12fceb09e91f0
SSDEEP
1536:a0qiQWEVZIXNsV2eId6iHCj/JtiRwTLyQwx0:rmzIXNsz/tuCLyQwS
resource | yara_rule |
---|---|
sample | modiloader_stage2 |
Checks for missing Authenticode signature.
resource |
---|
61a2c42df24f9a46ae1176c95bfab761_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
MyHookOn
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ