DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
JmpHookOn
Behavioral task
behavioral1
Sample
efef3fc742f0f0ee8ec8e2e3f126a97c_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
efef3fc742f0f0ee8ec8e2e3f126a97c_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
efef3fc742f0f0ee8ec8e2e3f126a97c_JaffaCakes118
Size
56KB
MD5
efef3fc742f0f0ee8ec8e2e3f126a97c
SHA1
0dd899e3d4073dec604490935d6cc4663407644f
SHA256
920afec9442ac3d3a4688e3cc1a913683131285fc42c21c5aab06628cf689c13
SHA512
3dac5d2b3c3e64c39af63463d6d5cdc1329414e94d0bbc3902e502863a2f64b143c3e4fa75276d433d2733e4afa3721bbcae6e67f9ec550d537def2405ab98b3
SSDEEP
1536:lSqPZmQhzvmYYaQd5D7JzLPooxYdh/R5kN9Q1NuIGpggol:XZmIvmr7JHQoxGh/R5kzQ1NJGSgol
resource | yara_rule |
---|---|
sample | modiloader_stage2 |
Checks for missing Authenticode signature.
resource |
---|
efef3fc742f0f0ee8ec8e2e3f126a97c_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
JmpHookOn
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ