DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
Exifer/Exifer/Exifer.dll
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
Exifer/Exifer/Exifer.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Exifer/Exifer/Exifer.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Exifer/Exifer/Exifer.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Exifer/Exifer/ExiferShellExt.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Exifer/Exifer/ExiferShellExt.dll
Resource
win10v2004-20241007-en
Target
cb4da8d6687f68a0be74c739e99e8d6e_JaffaCakes118
Size
1023KB
MD5
cb4da8d6687f68a0be74c739e99e8d6e
SHA1
70549e46d78a5918d999d9b79addfa24d62017f5
SHA256
a78e9fe40033af4805bfaddb4fa8b449010fbe0a329569e54583ddba6a76972c
SHA512
01ba83381fb87b2fc15792d461ab4475cf12f3a2295d6b83ccbbc4db59bf9265b4e9067fd5630e434cf00e36553bdd603ef754c250d0e1dec02b1961bcc96afd
SSDEEP
24576:QE+z2tCxXcI4tzcYD3+0jyZ30yesjISzxNyGgukmURQ3:xdCJZ4tzcYD3+eyOycqlzkmUK3
resource | yara_rule |
---|---|
static1/unpack001/Exifer/Exifer/Exifer.exe | modiloader_stage1 |
Checks for missing Authenticode signature.
resource |
---|
unpack001/Exifer/Exifer/Exifer.ENG |
unpack001/Exifer/Exifer/Exifer.exe |
unpack001/Exifer/Exifer/ExiferShellExt.dll |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ