d2c5334d2aa1a8766a9c7f610734ef4c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d2c5334d2aa1a8766a9c7f610734ef4c_JaffaCakes118
Size

39KB
MD5

d2c5334d2aa1a8766a9c7f610734ef4c
SHA1

3abe5e327ea96b38989734772b118e0ffdc960c8
SHA256

903bda7d44862c06d9e22848f49e286aed1579fa1c590c4b0c8f7c20d1fea213
SHA512

31d8b3be273800913ab94d207305772e4ab0b1414c6dce13dfb61bb01923156b2babb1a7013fcfc01601f42da6a8626b95c1f64f6d105f486aa3d1de2a793548
SSDEEP

768:jdW1Izo5pLdejrkvdw0gZNFAkLlsOKanbcuyD7UiPP9I:jdW1qo5ju6G0U3lsOKanouy8iPPi

Score

7^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d2c5334d2aa1a8766a9c7f610734ef4c_JaffaCakes118

Files

d2c5334d2aa1a8766a9c7f610734ef4c_JaffaCakes118
.dll windows:0 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

WahCloseApcHelper
WahCloseHandleHelper
WahCloseNotificationHandleHelper
WahCloseSocketHandle
WahCloseThread
WahCompleteRequest
WahCreateHandleContextTable
WahCreateNotificationHandle
WahCreateSocketHandle
WahDestroyHandleContextTable
WahDisableNonIFSHandleSupport
WahEnableNonIFSHandleSupport
WahEnumerateHandleContexts
WahInsertHandleContext
WahNotifyAllProcesses
WahOpenApcHelper
WahOpenCurrentThread
WahOpenHandleHelper
WahOpenNotificationHandleHelper
WahQueueUserApc
WahReferenceContextByHandle
WahRemoveHandleContext
WahWaitForNotification

Sections

.3V261i7
Size: - Virtual size: 80KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.7ft4wT5
Size: 35KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Wka8TO6
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE