ati2kaag
Behavioral task
behavioral1
Sample
3278c83e740edf3e6b5875059c319055_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
3278c83e740edf3e6b5875059c319055_JaffaCakes118
-
Size
23KB
-
MD5
3278c83e740edf3e6b5875059c319055
-
SHA1
d256c17d6cd0fa424a6e1c81ee307129fc3cea7e
-
SHA256
05cc0e28d34f379aafe26a867578c7f8e3d7e3d23de439b1a84dbe14cc5561f1
-
SHA512
05b620b818e16ae9ded8ddcc94da9550d84b5ac8341f524e6ecbcf2eea92cc786b404339d1985562960c25a4ff51b04b40dd96bbab27c53cc685e92a4e5896e0
-
SSDEEP
384:l8sKg71TkajgUittIyk/v3oJJ4BTiq+rPkDahz+0Art2B78tk883blEkb6:l8hgTkvTvu3oJJ4BkPlhz+Oh8tQrym6
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 3278c83e740edf3e6b5875059c319055_JaffaCakes118 unpack001/out.upx
Files
-
3278c83e740edf3e6b5875059c319055_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 204KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 22KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.text Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 166KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ