Run
Behavioral task
behavioral1
Sample
6256448292fb48ce87dae21943c623ab_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6256448292fb48ce87dae21943c623ab_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
6256448292fb48ce87dae21943c623ab_JaffaCakes118
-
Size
465KB
-
MD5
6256448292fb48ce87dae21943c623ab
-
SHA1
3fb832d15a1c345eace39981b5b4fce27939157a
-
SHA256
c2b3eba8e35d9d3312e1d98e040a09a4eb0f8c83cdd72718bbfb3664a0c46e95
-
SHA512
037f9bd0897d225d1417b8d334e7cee3156f234593a089cfa8d1651f3dcef50d91fe77a8fc7d425994437e32bf6bd4835f166ad3622c6b2f8557fe23654ca9de
-
SSDEEP
12288:G0BNnaG3IUyIhMkL/bjOKVcoWu5D6F1I411Rzn3+vg2z:G0BNyIhMkH6ov5D8C411tn3+vg2
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 6256448292fb48ce87dae21943c623ab_JaffaCakes118 unpack001/out.upx
Files
-
6256448292fb48ce87dae21943c623ab_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 704KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 323KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 141KB - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.text Size: 436KB - Virtual size: 433KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 208KB - Virtual size: 207KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 60KB - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 156KB - Virtual size: 155KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ