CreateMainProc
CreateProtectProc
DllCanUnloadNow
DllGetClassObject
Setup
SysLogoff
SysLogon
Behavioral task
behavioral1
Sample
eb939cf8a0f0a72518be5d3ef8a6b2f6_JaffaCakes118.dll
Resource
win7-20240903-en
Target
eb939cf8a0f0a72518be5d3ef8a6b2f6_JaffaCakes118
Size
270KB
MD5
eb939cf8a0f0a72518be5d3ef8a6b2f6
SHA1
262206e90b11edb06ba77a38015740801ac78894
SHA256
625a60a0de1117cc9ea5a5f53462425f610dcde2aba8221dff15bf21ee760518
SHA512
65356de6261a9fa57887320c552f3657a214755bde2a4122c79ccce4e57470c617df8621ddf907a35c874e84bd71c324b6c78b3ec30bd208e88389f6c76e7951
SSDEEP
6144:jBgnj+U3NhKkPIneL2lL07jVl8KPskeaeNML1fww3/WY0xAFwuh2mT3rx:+jV3NhKkwG2lo1mPPaSMLdww3uhxAFwQ
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
eb939cf8a0f0a72518be5d3ef8a6b2f6_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CreateMainProc
CreateProtectProc
DllCanUnloadNow
DllGetClassObject
Setup
SysLogoff
SysLogon
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE