DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
JmpHookOn
Behavioral task
behavioral1
Sample
120027dea5dd2234e015a908575cbec8_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
120027dea5dd2234e015a908575cbec8_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
120027dea5dd2234e015a908575cbec8_JaffaCakes118
Size
148KB
MD5
120027dea5dd2234e015a908575cbec8
SHA1
5438398acdf3f1b3c58f6e3ed2341705d30133f7
SHA256
8b4eebfbf57aee5463882448a8747cdc04b3019a5c45f0a6c2198aaa838af8ff
SHA512
edc893ffe03f55e80e1496d93b915a36f8690345c6980c155efb1db68ed96c86e0d2f1d28a5b95c03c3263d857f13698f8c5ba2ee0193694ca05e4c71835a303
SSDEEP
1536:GQ8qIQamaeCWj2DeiHCj/ud/WBVArXmvaXo8jN+HLPS0:GP3fEj1Qd/WBVAiopjN+HjS0
resource | yara_rule |
---|---|
sample | modiloader_stage2 |
Checks for missing Authenticode signature.
resource |
---|
120027dea5dd2234e015a908575cbec8_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
JmpHookOn
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE