HookOff
HookOn
Behavioral task
behavioral1
Sample
f9b8c5f42347036e4280e02b4c37f679_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f9b8c5f42347036e4280e02b4c37f679_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
f9b8c5f42347036e4280e02b4c37f679_JaffaCakes118
Size
46KB
MD5
f9b8c5f42347036e4280e02b4c37f679
SHA1
53900e343f13b59b0efc26fff02393bb22fe069b
SHA256
40fa58125b4b4a3a2910ed5c81bc7db77b9b37b180dd545958c9bcf0d8a4a074
SHA512
c12145b061a9b49db053d18a482bdc7438de5354802153915393f74e2bb5dbb9756f2defbceed13c16dc5838192a5207e33de853e7397d9db865b663b400aea6
SSDEEP
768:wy5qsmQEwyVDj4bv0g1U7W9a8gnxcAnzDRKwLKrzW48hEfFd5gsmtK:n5qsmQIEbvdW8QnzDRKwLba9nyK
resource | yara_rule |
---|---|
sample | modiloader_stage2 |
Checks for missing Authenticode signature.
resource |
---|
f9b8c5f42347036e4280e02b4c37f679_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
HookOff
HookOn
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ