b45d7c17f4b31c9f4e1cd793141e7e4d_JaffaCakes118
- SHA256 a7d8fad69caf6f20b0e5d0dc32a68b382b6100baf5ca7895ff98f1146fb6a58a
Behavioral task
behavioral1
Sample
elfbot.dll
Resource
win7-20240708-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
elfbot.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
elfload.dll
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
elfload.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
elfload2.dll
Resource
win7-20240705-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
elfload2.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target b45d7c17f4b31c9f4e1cd793141e7e4d_JaffaCakes118
- Size 891KB
- Sample240821-v2dr1a1flb
- SHA256 a7d8fad69caf6f20b0e5d0dc32a68b382b6100baf5ca7895ff98f1146fb6a58a
- MD5 b45d7c17f4b31c9f4e1cd793141e7e4d
- SHA1 8c354b2eec675735cdb8a91fa586eeab929fcb85
- SHA512 98f8e93e56f5803e52c96a74ffb8d2008f5a82608bd54704e0600ab29edb642045682958fa39f212159a83dd4e2ecba9714bbf45b32e85ea73974aaaf7de5379
- SSDEEP 24576:aqve97MUZjg9qI2e0IwluMAwtA2NptIeVvsDqS5k60MU:Xs7MgEpYmcItDqS5O7
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule static1/unpack001/elfload.dll acprotect -
resource yara_rule static1/unpack001/elfload.dll upx - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/elfbot.dll unpack001/elfload.dll unpack001/elfload2.dll
File Explorer
-
b45d7c17f4b31c9f4e1cd793141e7e4d_JaffaCakes118.rar 891KB
-
elfbot.dll.dll 1.4MB
-
elfload.dll.dll 41KB
-
elfload2.dll.dll 35KB
elfbot.dll
- SHA256 eb84edb1b813e5b433607fa3ea4a4c344059fcb099b2380976879ddab08408b6
- MD5 9b948e02a141517d50a5328bda57e965
- SHA1 262eec74677e50e85952fd7e0a256adc64db431e
- SHA512 03418fbaac748f6e8053c56610a653601209eafb6d1273b43f340afb6f7b0347dbd95ff4790df76394dba9d96ae273b0f58a22669ea4a692dbe83eafed610af5
- SSDEEP 24576:vi0Tf1DxMVVvmdrjM+TrQRlUsh5SEjPtA8JP9WVoAgYxcZ6mdL:vvMVYBM+TsfUI1d9gorYhml
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3491589
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
EcInit
Name
.lvgf
Size
Virtual Size
239KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.utoas
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.ieupg
Size
Virtual Size
2.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vjnpx
Size
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.lvzy
Size
544KB
Virtual Size
576KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.ezhpv
Size
52KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.hutjlo
Size
108KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.lstx
Size
4KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fhnqy
Size
36KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.gjcq
Size
656KB
Virtual Size
704KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.dywt
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=4, id=1, productName=Unmarked objects,
count=2, id=25, version=9210,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=7, id=18, version=8444,
count=184, id=19, version=8078,
elfload.dll
- SHA256 f12023454301b8ee349f9f474fff2996c85550648c363a8b1ac6d006525b4bc6
- MD5 0a58c05d59777d16b2ad9ec32a6ecb44
- SHA1 cb6f7c57e3c13ea8bad04fac896753152eb68660
- SHA512 51b7d1d91297246d5d0eafe7e87ec0d3369744d8631797d6373e089823d0f4ce42c2454e5bdb7fe34e2ed191357a72d31aac8b919834fab3f6c031af7bba0aa9
- SSDEEP 768:fC6dfYQd2bFt6oxs+iqDjw/0d0mZoowhnUVeWdIXnbcuyD7U4xejYlIxS:fCkYDbT33jw/0tZ4nWvonouy84FIc
- MD5 SHA1 SHA512 SSDEEP
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
103696
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
Name
UPX0
Size
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
24KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
elfload2.dll
- IMPHASH 095172e783427c1a2072d5926f867e01
- SHA256 4d6980fec7777a4557a08eceda8f77e8cad70e56f4da563ec4e3fac1b4e423f1
- MD5 962687402f3ff0259618a668f9baca6d
- SHA1 9a06c69fc674c03dd0515feb24853403e15833f2
- SHA512 497852d2deb3ecddbc10ac07a6153b9bd7d31abcdaea30ae19dc0792eee2f77e34d5547357d0a43dee26111f6edfa83c9372f4ff42917fc378daed3252e70528
- SSDEEP 768:+ho2807sCQC7WiwJjKegezHsIvqZhmfKkap0AfTWRewFAdI0bdc:a7sCX7WiwJjKegezHsIvAJJ0ACRzAG0O
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
user32
TranslateMessage
RegisterClassExA
PostQuitMessage
LoadIconA
LoadCursorA
GetMessageA
DispatchMessageA
DefWindowProcA
CreateDialogParamA
kernel32
lstrcpyA
lstrcatA
WriteProcessMemory
LoadLibraryA
GetProcAddress
GetModuleFileNameA
GetCurrentProcess
CreateThread
ExitProcess
ExitThread
comctl32
InitCommonControls
Name
.text
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
723B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
405B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
320B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=18, version=8444,
count=78, id=19, version=8078,