Behavioral task
behavioral1
Sample
bbdd4d9df148de78bbfd01339d1f51b4_JaffaCakes118.dll
Resource
win7-20240705-en
General
-
Target
bbdd4d9df148de78bbfd01339d1f51b4_JaffaCakes118
-
Size
62KB
-
MD5
bbdd4d9df148de78bbfd01339d1f51b4
-
SHA1
15259a6e56e02ea45fc737801f3a7b6e50154838
-
SHA256
2e684f2ade7692c9c86a5f3dfaa83fdd6a3d45f73f186020556b6fed731059b1
-
SHA512
2abf888faa1c6e0177c37295d39a3f5f1054667ac0457a5b63af4f11c61a02ffcc83666b080e0cbad3338ed5ba10b000b5658da49fae13d7667932a06e93bb92
-
SSDEEP
1536:l5HhgMGDXlo1eMhpP07acPeTNWq7NNolR9D9trZxHPtrpHYKBu+M:LhxGDVokMhps7acYNWPlRdRxH1J9Q
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource bbdd4d9df148de78bbfd01339d1f51b4_JaffaCakes118 unpack001/out.upx
Files
-
bbdd4d9df148de78bbfd01339d1f51b4_JaffaCakes118.dll .ps1 windows:5 windows x86 arch:x86 polyglot
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
UPX0 Size: - Virtual size: 264KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 59KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.dll windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.text Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 229KB - Virtual size: 229KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ