Behavioral task
behavioral1
Sample
b8b579d7a696d7d095baa022850e2f24_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
b8b579d7a696d7d095baa022850e2f24_JaffaCakes118
-
Size
24KB
-
MD5
b8b579d7a696d7d095baa022850e2f24
-
SHA1
7e68b053b784baf91889213c6975e3fd2f71df06
-
SHA256
8efdbb0d6d00adcabf4250c8104243704ac914261611bf3b390916c47dded1b9
-
SHA512
b70a89fcbee11c1741c6055e23dcd90b09863dca4bb4fe17a7bda219c79beed3c0f659fbc9a3bcc86fc0384fcd498fc4c2ea7fcc2fb79d932909cdabeb7414c8
-
SSDEEP
768:tnDR8WMC6nbcuyD7UWvvhXfnSv1rs8e4BnmoeAMTH2:v8k6nouy8WvZPKXeHH
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b8b579d7a696d7d095baa022850e2f24_JaffaCakes118
Files
-
b8b579d7a696d7d095baa022850e2f24_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
UPX0 Size: - Virtual size: 276KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 72B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ