RunDllHostCallBack
Behavioral task
behavioral1
Sample
41aee6fec4749c435138e58c9ec46fc5_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
41aee6fec4749c435138e58c9ec46fc5_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
41aee6fec4749c435138e58c9ec46fc5_JaffaCakes118
-
Size
69KB
-
MD5
41aee6fec4749c435138e58c9ec46fc5
-
SHA1
e41270313cc91ff20de5cc9d7609ed3c36a1e67d
-
SHA256
f08d6213ea83c5d811cd1fe09b3532f3b60f48ee020815f701b8080e9b14479e
-
SHA512
bafcbccccb5de101d567d5edffdda02a8e5ca56d530c806723a5c30082ffbc431fdd3a27655b8e6c0cb2b082f3d50fd6587608ae2752ed44c4235ff21d8d129a
-
SSDEEP
1536:l+kaFBLW176v7UHlkHcE1DviAkrbwUlDupPoxZGRw5zOK4xZHzDnf0P23u4W:lbaKUelu917iAk3wUkSZGONMZTj0P5
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 41aee6fec4749c435138e58c9ec46fc5_JaffaCakes118 unpack001/out.upx
Files
-
41aee6fec4749c435138e58c9ec46fc5_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 14KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
tldksods Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ