DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
JmpHookOn
Behavioral task
behavioral1
Sample
fe6be224de2d1a7d0d6d61e4d687bf90_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fe6be224de2d1a7d0d6d61e4d687bf90_JaffaCakes118.dll
Resource
win10v2004-20241007-en
Target
fe6be224de2d1a7d0d6d61e4d687bf90_JaffaCakes118
Size
153KB
MD5
fe6be224de2d1a7d0d6d61e4d687bf90
SHA1
2a86fbcb73036406263264d02e4322da11e91829
SHA256
4e9e7c8f95fc47aa70bf68693c2a185ffd800a99d0e406a03ddecb4154479002
SHA512
ef2d95b2372a14d60de679f116178378597dc1fb2694060b6f16f936b5850e02ed808b5b03eba8bdc1c236cc1704e47c9f1fa6f20182dff35e2d1cc2f02a5d50
SSDEEP
1536:bm29MqfE3QmMOoW+DU7iHCj/XsO+JJs/X23BOnuhpUMejJIlGlxo:bHqvMOooxMs23cnunUPJ3
resource | yara_rule |
---|---|
sample | modiloader_stage2 |
Checks for missing Authenticode signature.
resource |
---|
fe6be224de2d1a7d0d6d61e4d687bf90_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
JmpHookOn
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE