Install
OffEvent
OnEvent
QueryStartSequence
StartFoo
StartMain
Uninstall
Behavioral task
behavioral1
Sample
a48b4fec48722beb6f28357e9b061e6e_JaffaCakes118.dll
Resource
win7-20240704-en
Target
a48b4fec48722beb6f28357e9b061e6e_JaffaCakes118
Size
247KB
MD5
a48b4fec48722beb6f28357e9b061e6e
SHA1
ad9a800c46913852d87e38cae2c08aab6dcc6aaf
SHA256
b2be7dd682160ede6accb28e8f903a81c659f1349e2718e65e77987026756d28
SHA512
23d0c7937433154fbaad682c9c41cbc2473bce74115c0b93299935bc502df72e9cdf47b8754c165da9552f2acab53e3c8096fb4791ec13a20a9f9bf731bae97c
SSDEEP
6144:sqY8xcB22NVNkya4Lxmu9RNuPf1+ftlfTkgdcsw+c2NM:r1xc1ZkiLxmu9RNuYfP7esw+c26
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
a48b4fec48722beb6f28357e9b061e6e_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Install
OffEvent
OnEvent
QueryStartSequence
StartFoo
StartMain
Uninstall
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE