Behavioral task
behavioral1
Sample
d23480593dfeedbaf1a5469ee6f89c37_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
d23480593dfeedbaf1a5469ee6f89c37_JaffaCakes118
-
Size
72KB
-
MD5
d23480593dfeedbaf1a5469ee6f89c37
-
SHA1
cc01907ad98b1eafdd5a50ee89f03ad07892c4c4
-
SHA256
0275a611d5217a995bcac670d6f551373a3908fa1843831ac50f9339cb54c869
-
SHA512
742377ed69d2bf8c1a00c019a8594ea7299cfd6849baa6bb5cb082dc93a7ecf9f7cf4b79cc1e0f094fb71ce1a9dbe3374b8488a8a82c6b398a0570cced2af11d
-
SSDEEP
384:r63FUAEgL68cNP/X/DiXABlk6lY4FWWFrPSvnnaZKa1ICRx1BxaOHAjNNtu:6vFLhc/Xl7lY4MsrqvkqCVrHAjNN
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d23480593dfeedbaf1a5469ee6f89c37_JaffaCakes118
Files
-
d23480593dfeedbaf1a5469ee6f89c37_JaffaCakes118.dll windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
UPX0 Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE