UnHook
WSPStartup
installhook
Behavioral task
behavioral1
Sample
bda5f9938b75d2ece406c141b3fc1ac1_JaffaCakes118.dll
Resource
win7-20240705-en
Target
bda5f9938b75d2ece406c141b3fc1ac1_JaffaCakes118
Size
120KB
MD5
bda5f9938b75d2ece406c141b3fc1ac1
SHA1
a21f6e6058c50bcc868d45217e772720b9fdaa24
SHA256
490ba7f0492a66bb864296e9d66652c79b558ea73b4a23d3f42db8ba8a44fb34
SHA512
d8f103cd75bc1696a3f482f4adb56cee0ed763f824e622907da033661b043629bdacb17936cc6fb9f38a29e5050e00c1416ebad71462535541c5e5f07a49486b
SSDEEP
3072:8NxLxAE9QQ9qf/Gw2InXhpGDTF6puVchcfarRcICopz:8vaER9qf/hXETFruEarOICopz
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
bda5f9938b75d2ece406c141b3fc1ac1_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LoadLibraryA
GetProcAddress
ExitProcess
UnHook
WSPStartup
installhook
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ