Behavioral task
behavioral1
Sample
d3a9c02d098897e3254ac898ae880382_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
d3a9c02d098897e3254ac898ae880382_JaffaCakes118
-
Size
10KB
-
MD5
d3a9c02d098897e3254ac898ae880382
-
SHA1
4fbe58756aef9e4930216194978cc5766c3e4123
-
SHA256
5d44caa8db2c7582141678a8cd83997607263bcc8ea1ce27c76d0c68864e23f8
-
SHA512
8f8da5b64073a5f8601b14fa31d0e88a0043fceb330330b4259ee629135db8d522209697b5fb57f610aaac81c8009b38720bb0fcd656817056eeac92db93fe6d
-
SSDEEP
192:laRXbLC687MDtPBJM2gbypiMIlOqybRnwiSzNL+H:Iy6Zz3NiMI+2i
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource d3a9c02d098897e3254ac898ae880382_JaffaCakes118 unpack001/out.upx
Files
-
d3a9c02d098897e3254ac898ae880382_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
UPX0 Size: - Virtual size: 28KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
HookStub Size: 512B - Virtual size: 423B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
MiniPE Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ