Behavioral task
behavioral1
Sample
0d1353889547ba84e08f0ec93f344d9d_JaffaCakes118.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0d1353889547ba84e08f0ec93f344d9d_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
0d1353889547ba84e08f0ec93f344d9d_JaffaCakes118
-
Size
39KB
-
MD5
0d1353889547ba84e08f0ec93f344d9d
-
SHA1
3894cf9e37f6ab05d572b2301aa9586288767934
-
SHA256
acc9002a2fa0044312e47b55315e77758cd9f6a4b0ef9a6c0864f4f0bdf07bb4
-
SHA512
bf2fd992244e2538204ec3848a8dd7a92b3fa0b0e3236964c4444fc17483af608aff19a6fe4e5bd2bc337db9d19f634e9408ceb85cdeb9758fd5a069b1e1146c
-
SSDEEP
768:X6IVqQul2dhBU8C8AFXDbgU8qS1oCDJL+qkrPP8rgCtr19P:XJcLl2d8JZngU8qap5PkzP8rgCd19P
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 0d1353889547ba84e08f0ec93f344d9d_JaffaCakes118 unpack001/out.upx
Files
-
0d1353889547ba84e08f0ec93f344d9d_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
UPX0 Size: - Virtual size: 224KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 36KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 197KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 744B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE