F1122
Behavioral task
behavioral1
Sample
a0f4c2a95e79db506f1057551d9e632b_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
a0f4c2a95e79db506f1057551d9e632b_JaffaCakes118
-
Size
203KB
-
MD5
a0f4c2a95e79db506f1057551d9e632b
-
SHA1
7fa79d65c985edf86b46505bf38cca78846419c5
-
SHA256
c43f22475938f5f8df2dd679b69a8453c9f53af7692d9c29fa00e0a24a19ba59
-
SHA512
18c7cb53d9c8252f4937961128d4395f669197e15bbe804fe4e82d6c104fd94302fbbb3f0640dc2a1e82fbdd794f563105d6b16c5e93db493144ec9f0080e477
-
SSDEEP
3072:rahFx9x57aOQpywIekC65ZF6puB0ZU+6qspumumSF8/UUDHqK0MLpPtKduEEQ8go:gapF6H6puB0UuJt8MDKvK58T7Jt4oSn
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a0f4c2a95e79db506f1057551d9e632b_JaffaCakes118
Files
-
a0f4c2a95e79db506f1057551d9e632b_JaffaCakes118.dll windows:8 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 188KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 199KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE