Activate
DllCanUnloadNow
DllGetClassObject
HookProc
Logoff
Logon
Start
Behavioral task
behavioral1
Sample
11d5a0f847381c1908a983746d85abbe_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
11d5a0f847381c1908a983746d85abbe_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
11d5a0f847381c1908a983746d85abbe_JaffaCakes118
Size
26KB
MD5
11d5a0f847381c1908a983746d85abbe
SHA1
a501d5dd791a25868aeaf831d9a556a4c1d95f0e
SHA256
d40cd384070b0972ece63d5d7ca0bf40499ba4c883b74dec522dec49e5d2af86
SHA512
13b2a5018856f8cc40545e93ab8d31922ff1271f2cdd58cee79b10bbdca3199db79cc15458080ac87eb0dcdf2e905cefba771f7559dba12de0434678e1cb25b2
SSDEEP
384:otY/shYtBBblC1VRWPyOxtz41XLnQpKsKhPM7aG3oAVNUtLL:ewsitBd81VRWqOxcLn7NS6YNcL
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
11d5a0f847381c1908a983746d85abbe_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Activate
DllCanUnloadNow
DllGetClassObject
HookProc
Logoff
Logon
Start
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ