Install
OffEvent
OnEvent
QueryStartSequence
StartFoo
StartMain
Uninstall
Behavioral task
behavioral1
Sample
1133a435ea26fe646acd9b22257347d6_JaffaCakes118.dll
Resource
win7-20240903-en
Target
1133a435ea26fe646acd9b22257347d6_JaffaCakes118
Size
250KB
MD5
1133a435ea26fe646acd9b22257347d6
SHA1
35709fef0860a072322299a1934d17f1876b55ba
SHA256
e9556c33f8bfab830a4fc37c7e5c10f582d7efbd6f7e2366ef6f5d338718824f
SHA512
8e4a7a7629c837f7e29155d3677eae8f219fe3a162d36fab5487898367c43bb15dd74732e494a14143a7e951135675df4cc18c44817e77c1b70148f1f4b8818e
SSDEEP
6144:U2NnpqH7xJoxETpueh+4aFagYF9EzqdWxNCjz9v6:UcWxJoxMuxs0qdWOjJ6
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
1133a435ea26fe646acd9b22257347d6_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Install
OffEvent
OnEvent
QueryStartSequence
StartFoo
StartMain
Uninstall
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE