RunDllHostCallBack
Behavioral task
behavioral1
Sample
85a937ca57b69d2bc6e7c391b25a22aa_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
85a937ca57b69d2bc6e7c391b25a22aa_JaffaCakes118
-
Size
74KB
-
MD5
85a937ca57b69d2bc6e7c391b25a22aa
-
SHA1
b10ea5d3087ae56fa7f9d16e6465c3be572e53f1
-
SHA256
5f9d49d75e185dd757866148b3f31e66f3ab0a451124140079407c10b3a89e90
-
SHA512
5c9ee22b56cf424797d950aeddfa0f91440df6e5be2da247e833c1e5e3ea4ed994ca1d3a0d6b18235a73eed73eef80998b204b09d2f2057303e4a991d3586627
-
SSDEEP
1536:q+gWgHmrDQNFDHZS+iyvgSdqwzWatK3bUD/QeDyFHD99LsXv5E:IOgDZSCvguoLUD/BYHJ9Ls/5E
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 85a937ca57b69d2bc6e7c391b25a22aa_JaffaCakes118 unpack001/out.upx
Files
-
85a937ca57b69d2bc6e7c391b25a22aa_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.text Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
tldksods Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ