ServiceMain
Behavioral task
behavioral1
Sample
662a159dccf50f94aa84f036ba52c3a9_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
662a159dccf50f94aa84f036ba52c3a9_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
662a159dccf50f94aa84f036ba52c3a9_JaffaCakes118
-
Size
7KB
-
MD5
662a159dccf50f94aa84f036ba52c3a9
-
SHA1
dd4e0cf87b4347e996a1f7a36f2d3c502291f91e
-
SHA256
b2a6dba13b84e5c20fe78c43a34f21636895007b02b7ccd1a074e24e685c6f82
-
SHA512
b5c3cc9738947814c6b3a452789281b39697884778c4f295c8039e083f061eda26c07cde66f374e80e0fef5a4896e82ef7dd9f5525b65e9c0068161a463b162c
-
SSDEEP
96:fFt58eIO0O9RnToRG7RcwaNtgd9Naz3AVovEepTUdZBl6PlTSYEWRe8R+WwGhX:NAeZvfToT3cSbOo8KYXv6dTMWk8R+Wb
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 662a159dccf50f94aa84f036ba52c3a9_JaffaCakes118
Files
-
662a159dccf50f94aa84f036ba52c3a9_JaffaCakes118.dll windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 20KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE