Behavioral task
behavioral1
Sample
2930c5423fdb3a9565806bb5fc6b7ffd_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2930c5423fdb3a9565806bb5fc6b7ffd_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2930c5423fdb3a9565806bb5fc6b7ffd_JaffaCakes118
-
Size
217KB
-
MD5
2930c5423fdb3a9565806bb5fc6b7ffd
-
SHA1
2a1510619e513af44d4fb5214ed2ce358e73d72d
-
SHA256
7c66051e13580b89612b7f56f1e547685920da9773317375dda5ef8399c0e29e
-
SHA512
89b45bec241ac838c8c5c0dca488dbb13c7180989573fd9a28a7261f0a5b852fe663281d2684e7b5be243ae315c5c24520c36c2908b379b4ab6e83bfc69c79d1
-
SSDEEP
3072:m1AdNYY5hzB+6Q3c7vFOM8rXo0mUHTpkBQSVBt7VFo/D0sHpH2LN1Fe7MIx2w:eAjRB+6L7vGr1deQSV/ArJ2LN1Fe3x2w
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2930c5423fdb3a9565806bb5fc6b7ffd_JaffaCakes118
Files
-
2930c5423fdb3a9565806bb5fc6b7ffd_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
UPX0 Size: - Virtual size: 508KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 211KB - Virtual size: 212KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE