Rool
ServiceMain
whm
Behavioral task
behavioral1
Sample
f6e0bc7ba6b458605c5597b61dd3b8bc_JaffaCakes118.dll
Resource
win7-20240903-en
Target
f6e0bc7ba6b458605c5597b61dd3b8bc_JaffaCakes118
Size
59KB
MD5
f6e0bc7ba6b458605c5597b61dd3b8bc
SHA1
747d6a7a139fd5240634db8ac2f8dce049d78b2e
SHA256
359ee16ef179bdae32af6a9491b1fd0c2883b28c95d221764d1705e697de6ab2
SHA512
d4715774054c92a6647f5ddabed0d63c2a43c794e7542c8c745919f35ec4ddfe90cd687d7adfe56d2a205cb84b72d604bf5fe30a4d497224d63e9443e8aa9db2
SSDEEP
1536:07LeQCn905FnLCC8d8hZ73R1k5bZvMEh6g9KSD5cEVTY:0uQGe50C8m3R14tEFEVTY
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
f6e0bc7ba6b458605c5597b61dd3b8bc_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetModuleHandleA
LoadLibraryA
GetProcAddress
Rool
ServiceMain
whm
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE