Static task
static1
Behavioral task
behavioral1
Sample
ad73ee6d16089f1b9f3ef334f294a40b_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
ad73ee6d16089f1b9f3ef334f294a40b_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ad73ee6d16089f1b9f3ef334f294a40b_JaffaCakes118
-
Size
312KB
-
MD5
ad73ee6d16089f1b9f3ef334f294a40b
-
SHA1
b32a1d34ae3606ff9356e66fd389f5c01e32a290
-
SHA256
61aaf6f3ecd613f7cbff412c50f6f774f8af8a5274301d8b547eff063809271a
-
SHA512
feac4529982ef488c5f1f4aa8ca913d24193d502f09df7bce3dfb74c65e340c79f93f71ad85187a3ac0ef40e1b6f07a2e27b5f2b83bab27064f2d759aa635006
-
SSDEEP
6144:2gUA4FdnD7fbwkZQReSYbWMIrxnY3I/ktUgH/:2gmtcXdYbp81Y3ui
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ad73ee6d16089f1b9f3ef334f294a40b_JaffaCakes118
Files
-
ad73ee6d16089f1b9f3ef334f294a40b_JaffaCakes118.dll windows:4 windows x86 arch:x86
fdbfec85672f73d2a4d49635454936d4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetProcAddress
GetModuleHandleA
LoadLibraryA
ExitProcess
user32
MessageBoxA
Sections
.text Size: 158KB - Virtual size: 512KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 18KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dswlab Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.perplex Size: 117KB - Virtual size: 117KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE