RunDllHostCallBack
Behavioral task
behavioral1
Sample
2afa354c9c236d1c52bca8a2c6a32dd3_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2afa354c9c236d1c52bca8a2c6a32dd3_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2afa354c9c236d1c52bca8a2c6a32dd3_JaffaCakes118
-
Size
269KB
-
MD5
2afa354c9c236d1c52bca8a2c6a32dd3
-
SHA1
6d1bb01662a52f5c3bc8b6d75b83c06012c2b3e6
-
SHA256
c8feb1341f93c9ce7984d58c3ba25208e88a2ca839a3030d5692fab6ad3f0fa9
-
SHA512
1620249889d00bde0983f8619a185f19c062a31a488192bb33327f5d1c2ae728d8d63ff7491ae15e0f779ecee2be90ae4b84f1348ee32f0921cad40e32576bdb
-
SSDEEP
6144:bLmzAuZD+GpRDVXQq2+8jxfKnJ9x2A9gaxen0gJp2hmfxdLrBO0oS:q1vda+hnJbTPQ0gJYh6drZoS
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2afa354c9c236d1c52bca8a2c6a32dd3_JaffaCakes118
Files
-
2afa354c9c236d1c52bca8a2c6a32dd3_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 692KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 261KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE