UnHook
WSPStartup
installhook
Behavioral task
behavioral1
Sample
c8e3e03e78c31cf2069a67e7d8a530e7_JaffaCakes118.dll
Resource
win7-20240729-en
Target
c8e3e03e78c31cf2069a67e7d8a530e7_JaffaCakes118
Size
120KB
MD5
c8e3e03e78c31cf2069a67e7d8a530e7
SHA1
e6030cb302b91a66d228c6187ada3411b5e4a576
SHA256
06b2181d5d2f1abb14e318a048555554edf806b3c7feb3e4fcffc174e06a82dc
SHA512
ba9d8df7fb3f0713f0b0c6b3e65f40c302e0dc0e7ab399d630cf90c0b5adb393cc34c8b39c03e572956fa34c052f2cdedfdb205ca7c17a19d3c54308ecbad203
SSDEEP
1536:AYfGyaoFOqjBo1NidL5JVczWlu8tWsHL08bv5SXFnZeoGVWDxdUdi8Jx8uJlYleX:PefkdoGLfC/qWsH7gFZpxds8FbkT
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
c8e3e03e78c31cf2069a67e7d8a530e7_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LoadLibraryA
GetProcAddress
ExitProcess
UnHook
WSPStartup
installhook
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ