DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
JmpHookOn
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
e420b5683dac9c18c7bd7e33d2bc1d9a_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e420b5683dac9c18c7bd7e33d2bc1d9a_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
e420b5683dac9c18c7bd7e33d2bc1d9a_JaffaCakes118
Size
55KB
MD5
e420b5683dac9c18c7bd7e33d2bc1d9a
SHA1
ea8d690030788cfbf4b79affd8c3033215744256
SHA256
5175e9ddcc842c0946843cd710413a396b0f97d9bc2f6316a56d30b13a1635af
SHA512
f26fda525e4779e422b48aee119c986a4e423a1c6a95ed43fb3bff50363f7c3a59f1987b4d7b58d4ef2317fd7774d07b3f0d186fb5789faa81e006ec7d6c81b3
SSDEEP
1536:NkqyQnony+nKRF6JC1NNiHCj/k8E/YXZC2:MgotWSb/YX42
resource | yara_rule |
---|---|
sample | modiloader_stage2 |
Checks for missing Authenticode signature.
resource |
---|
e420b5683dac9c18c7bd7e33d2bc1d9a_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
JmpHookOn
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ