UnHook
WSPStartup
installhook
Behavioral task
behavioral1
Sample
963cd3c26644c32b471530ee04c4846f_JaffaCakes118.dll
Resource
win7-20240704-en
Target
963cd3c26644c32b471530ee04c4846f_JaffaCakes118
Size
92KB
MD5
963cd3c26644c32b471530ee04c4846f
SHA1
b51b9734f110811ef53cf73bdc7e35e5829b8abb
SHA256
f602e6361176bdc33dc8a1da8e099003a28441423b930cf1dd245d6e71e68e83
SHA512
50eeb17a54844e7d80ee6f0d14abbf008cd18749903610314a161b2a1bef2f06760ae2bf8f3b529ffa936665d99496176a11f8a5027c796977daf283db9c06cc
SSDEEP
1536:h6ytrAprQmpQw4doHUD4ORVPsptuBMaA3bGjCSl9gwlVz6:g+AIs0D4ePwc2aALGTl9gWJ6
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
963cd3c26644c32b471530ee04c4846f_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LoadLibraryA
GetProcAddress
ExitProcess
UnHook
WSPStartup
installhook
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE