Run
Behavioral task
behavioral1
Sample
d0c1506dd1edf39070cc5889722f6851_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
d0c1506dd1edf39070cc5889722f6851_JaffaCakes118
-
Size
24KB
-
MD5
d0c1506dd1edf39070cc5889722f6851
-
SHA1
f5d979aa1be26fb13bc2244354e64474c6a48ef4
-
SHA256
e3e279f5955ab5e1cb15062e489044dd0ca9cbb510b3457489f4a826bbeb8fdb
-
SHA512
6a87ebd2ed08fe63a54c24ceee87db529e578484cadda8bebe633c59f7790c1d43f7ed34bbf733f25d22e592ab330b0f1ae06688c15e6b934ee40e8522ad9747
-
SSDEEP
384:RfVJDejC4mssadxfRt4FW5iMST+lyY9kKTcg2UOXqBLm9XgJzjbS:RfVtamssafR2cST+0iXnOX+mRGH
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource d0c1506dd1edf39070cc5889722f6851_JaffaCakes118 unpack001/out.upx
Files
-
d0c1506dd1edf39070cc5889722f6851_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 48KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 22KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.text Size: 32KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ