DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
MyHookOn
Behavioral task
behavioral1
Sample
03e77e0d7011df691a95d2e807fffc04_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
03e77e0d7011df691a95d2e807fffc04_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
03e77e0d7011df691a95d2e807fffc04_JaffaCakes118
Size
57KB
MD5
03e77e0d7011df691a95d2e807fffc04
SHA1
9125899e77bbc511caecc1c0d2111dfac7c41046
SHA256
ea4846f8ee3b174be683374dd4075b7c6d1890178cb0e6175a5f2bcfeb12a6ea
SHA512
a4623ddb9d576bfe5d514c7d27f48f19d22f33ac6ee2314ea78cbc21ed424c2f0f4aad03af82a3128cb425255987c84486c726a3cb6e9e92903cc159e3d2b244
SSDEEP
768:LC0qiQf+Eb5GRILmCDYKfBzad6iHCjMAO+ge3IkZwmtJyZRe5l995jSHmHBZBAnb:u0qiQWEV5Jzad6iHCj/ONrk5sRexg
resource | yara_rule |
---|---|
sample | modiloader_stage2 |
Checks for missing Authenticode signature.
resource |
---|
03e77e0d7011df691a95d2e807fffc04_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
MyHookOn
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ