RunDllHostCallBack
Behavioral task
behavioral1
Sample
acab716e29b1f885cd3904c8477b5c07_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
acab716e29b1f885cd3904c8477b5c07_JaffaCakes118
-
Size
52KB
-
MD5
acab716e29b1f885cd3904c8477b5c07
-
SHA1
f7849b9dbd287bcc53d2190f6fdd8a373ac265ba
-
SHA256
74db0c3c01024a0c667e13715169004e0080f6d1407e9cfb0750ad2c276e5be4
-
SHA512
8aa805e20754d119e2d873c7c80a022b79d2deffe09b4ca9fa4c34ce16fb9bdbe65195397f2431911969d8493c758e84bca2b4a8023a91fc090d29924fd507e0
-
SSDEEP
768:pWO1CRTkM5k7ch1BMP2geMokgQ5SVcmSfgmu5MW+qf6016q53NGOwF5kpBvmoWw5:pWOrM5lM5YFmNW+qds5Ugv78uxMR
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource acab716e29b1f885cd3904c8477b5c07_JaffaCakes118 unpack001/out.upx
Files
-
acab716e29b1f885cd3904c8477b5c07_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 24KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 915B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
tldksods Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 958B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ