ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
cf93672447974a8e0560049aab2efd27_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cf93672447974a8e0560049aab2efd27_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
cf93672447974a8e0560049aab2efd27_JaffaCakes118
-
Size
228KB
-
MD5
cf93672447974a8e0560049aab2efd27
-
SHA1
e7530b8722dea798499c671aaaa09ad849defbb2
-
SHA256
a2c148aab76af6c8cf954295f03d2cc0c5faac37f2cc9c45ffc44a63925809e7
-
SHA512
c8bc868bdf066591b94f1e9425d6db89df643f9a99e0981ca1673f380a6ea12702460adf8b5aab37b321724e728345ead9f22ff58a6fa5cd090acc39bfdc059a
-
SSDEEP
6144:NU0T90GuyIyeZq0Aou/fQ20GhCwghLBEg7CwLdJSKgjnjkQ:PFuCeZq0dKfR0oCwILnLvSKin4Q
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cf93672447974a8e0560049aab2efd27_JaffaCakes118
Files
-
cf93672447974a8e0560049aab2efd27_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Exports
Exports
Sections
.packed Size: - Virtual size: 556KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 228KB - Virtual size: 228KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE