DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
JmpHookOn
Behavioral task
behavioral1
Sample
a8a62d1c25b7cb337c538d4a910f790e_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a8a62d1c25b7cb337c538d4a910f790e_JaffaCakes118.dll
Resource
win10v2004-20241007-en
Target
a8a62d1c25b7cb337c538d4a910f790e_JaffaCakes118
Size
148KB
MD5
a8a62d1c25b7cb337c538d4a910f790e
SHA1
f263b244c7bdd8ac63a6a9b9f1f4d228d13a55ed
SHA256
c87a449ef9e4c34d0d8a68f5459bd8528acdb14674540de55ab8760dcb5afeeb
SHA512
aaf7b702572b21748173044cd5a08f1ec8a2a0354b9fd5d9b96cfb1cab3a65876b35c346c904b9acf3fbdb53c970bf82543f7674cbe8efc4440454dff503fcb4
SSDEEP
1536:BAqMQ2mieCvDHMcviHCj/uLRClBfb7puP+HgSDH:2PTRDHjQLRgBfblVpDH
resource | yara_rule |
---|---|
sample | modiloader_stage2 |
Checks for missing Authenticode signature.
resource |
---|
a8a62d1c25b7cb337c538d4a910f790e_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
JmpHookOn
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE