DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
JmpHookOn
Behavioral task
behavioral1
Sample
d02a81f8b4bcfbc2ddee697e8c9b57fd_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
d02a81f8b4bcfbc2ddee697e8c9b57fd_JaffaCakes118.dll
Resource
win10v2004-20241007-en
Target
d02a81f8b4bcfbc2ddee697e8c9b57fd_JaffaCakes118
Size
45KB
MD5
d02a81f8b4bcfbc2ddee697e8c9b57fd
SHA1
53492630dfbc2aba29826830cebbd474fd138e93
SHA256
f43361c56b9b2cd84e20f0d385a307a8626e32edc5ba7ee07a94c283ee04bcb3
SHA512
01e122566cc808ba31e87cb1a308a842dd5e1d16244d8be3291f15c108637c28e5128db14f3b4e1dd2fd53b6efbfc98a820bd2ab5a3eb176c81089be93d9da92
SSDEEP
768:b88t3HdfNSvuh0OjCEfejWkyr31pHMXnD7hdSXAJHm3rW:b7vYuh0OjrfeqRpyD7nbHcW
resource | yara_rule |
---|---|
sample | modiloader_stage2 |
Checks for missing Authenticode signature.
resource |
---|
d02a81f8b4bcfbc2ddee697e8c9b57fd_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
JmpHookOn
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ