run
Behavioral task
behavioral1
Sample
b7d5004bef0f467729a028d1e3400443_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b7d5004bef0f467729a028d1e3400443_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b7d5004bef0f467729a028d1e3400443_JaffaCakes118
-
Size
165KB
-
MD5
b7d5004bef0f467729a028d1e3400443
-
SHA1
1f7d1af6bc7061ea3254350a8ac28c134de6c3aa
-
SHA256
5735573e1c4a678ea0ff3a966db4d7bdebe75d84b669fff4858bd03f2e647968
-
SHA512
d9c329982d230b5de063704f72b109edde3520694bd909e31c1ffe8ce43e3150b49aee9e922a3d600cb9dc52fec76f5eefd1805922e12937e6de5403530c131d
-
SSDEEP
3072:ia3sh3AZ7jermUUBD6Xi+N3BRr0mRIcqNcKQopoaft+lL15YANipuorwGHFh3hL/:WhQZWrmNz+Nxl0mGc2cBQ0lL15YAkuRu
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b7d5004bef0f467729a028d1e3400443_JaffaCakes118
Files
-
b7d5004bef0f467729a028d1e3400443_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 13.0MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 164KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE