RunDllHostCallBack
Behavioral task
behavioral1
Sample
78a839834c0579648a4a1f1ce3a0d112_JaffaCakes118.dll
Resource
win7-20240729-en
General
-
Target
78a839834c0579648a4a1f1ce3a0d112_JaffaCakes118
-
Size
71KB
-
MD5
78a839834c0579648a4a1f1ce3a0d112
-
SHA1
102ec041c2fc33b3d6a2bdcba5e0ca6d94718ad5
-
SHA256
360cb01939a9ed67395761496ab5fada31dc5f1e085c73a25e5cf0d037886977
-
SHA512
5752521d462e7df3f3fb34d72e207f3dd2c49996b86a8e9bf4bcd132d2b258b9636b2d1898337535d6b189fcf1363346ca432b89bb81fdfcbece84da40086043
-
SSDEEP
1536:fEu/yDd1c/ue1kYTEpxAlEIokMS4RCUIvfIB4/im9S+vuiE8mXyGk:f/yDdm/u/YHlbzciw4Kz+G5Rk
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 78a839834c0579648a4a1f1ce3a0d112_JaffaCakes118 unpack001/out.upx
Files
-
78a839834c0579648a4a1f1ce3a0d112_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.text Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
tldksods Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ