Behavioral task
behavioral1
Sample
0882b6c5f8100a245cf3f5dfc36e3184_JaffaCakes118.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0882b6c5f8100a245cf3f5dfc36e3184_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
0882b6c5f8100a245cf3f5dfc36e3184_JaffaCakes118
-
Size
275KB
-
MD5
0882b6c5f8100a245cf3f5dfc36e3184
-
SHA1
762f2689e910fd3661471f78613c75abce19c70b
-
SHA256
cbc176f20907612fe2711e5039b0b4e65d42c2a7c7d46144d4e016fb93f5e11f
-
SHA512
27235b8f5cb05d251fe23cf5044b98e5fd24015678e8f53f134f2060bb6904d55ef48dec9a7d7ea477b79ef05fae928637eae304af3fd125cbbce683d92e8f8b
-
SSDEEP
6144:9czZxbZOYkD2ZzS/DTLhvyn92O/0foB98jVMi0P4N40YloS8:9czZZUDySHLhv892OMW98jV9y240goS8
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0882b6c5f8100a245cf3f5dfc36e3184_JaffaCakes118
Files
-
0882b6c5f8100a245cf3f5dfc36e3184_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
UPX0 Size: - Virtual size: 364KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 272KB - Virtual size: 276KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE