UnHook
WSPStartup
installhook
Behavioral task
behavioral1
Sample
ab1a8ce502cccef0366d9b566b1bb67a_JaffaCakes118.dll
Resource
win7-20240708-en
Target
ab1a8ce502cccef0366d9b566b1bb67a_JaffaCakes118
Size
132KB
MD5
ab1a8ce502cccef0366d9b566b1bb67a
SHA1
37d54478e10a9c3c197447d44425af3e5e1aebef
SHA256
0bf0b015b2b748f61787adfd17f04634c0a8be7552134ed0fdbaf7a4aa07117f
SHA512
b9f7a4990df2fd3c2819f5bbb768129bb5320ac7c1465901193c4aefe8f3e870f89df69ca02dd912d160452c4c43e595ec3c176d0931e42536f41d0fb2e4ac10
SSDEEP
3072:S2pbTZlPjaZyCJjn/4OO7s6m+y9oidt+l1L0U:/pbTZlja/JjnwR7of6ie0U
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
ab1a8ce502cccef0366d9b566b1bb67a_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LoadLibraryA
GetProcAddress
ExitProcess
UnHook
WSPStartup
installhook
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ