DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
JmpHookOn
Behavioral task
behavioral1
Sample
a6b516cd8ae31898a0020345078b85f3_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a6b516cd8ae31898a0020345078b85f3_JaffaCakes118.dll
Resource
win10v2004-20241007-en
Target
a6b516cd8ae31898a0020345078b85f3_JaffaCakes118
Size
148KB
MD5
a6b516cd8ae31898a0020345078b85f3
SHA1
58b244e126a70b1bc1824ab58bb98746ddbad5c0
SHA256
3f02bb9bb0b50bfb2d84cc442c91e806d76f65201a80544bbfd7c01365a02cc9
SHA512
b28b861ac1f6a0eed63de591d4d60a98c5164bed583aee469c8768c5ae01465890ae773a6edb847e5e32c57b16f01d6a944c3a5f50ea5dc2fd5d71796ac8d6a6
SSDEEP
1536:GQ8qIQamaeCWj2DeiHCj/ud/WBVArXmvaXo8jN+HLPSQ:GP3fEj1Qd/WBVAiopjN+HjSQ
resource | yara_rule |
---|---|
sample | modiloader_stage2 |
Checks for missing Authenticode signature.
resource |
---|
a6b516cd8ae31898a0020345078b85f3_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
JmpHookOn
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE