dcf415726e23e366450b50d8d1a2879f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dcf415726e23e366450b50d8d1a2879f_JaffaCakes118
Size

39KB
MD5

dcf415726e23e366450b50d8d1a2879f
SHA1

b4155c1b5d51ce5285e621cee1018f9c085cc8ca
SHA256

26548ea833c1698d9135b4b2cb1fbbaf5b17643f32f4fac78f35bdbf96857647
SHA512

c6d579982079338d478bd50c9e31c45951c4b51fe169ff82cfc2e46a3f7a8a5c3777539f017bf933d07c65051e6ca90d5d5cd23fcbbcacdf4e54a98ee38511b8
SSDEEP

768:AdW1Izo5pLdejrkvdw0gZNFAkLlsOKanbcuyD7UiPP9I:AdW1qo5ju6G0U3lsOKanouy8iPPi

Score

7^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dcf415726e23e366450b50d8d1a2879f_JaffaCakes118

Files

dcf415726e23e366450b50d8d1a2879f_JaffaCakes118
.dll windows:0 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

WahCloseApcHelper
WahCloseHandleHelper
WahCloseNotificationHandleHelper
WahCloseSocketHandle
WahCloseThread
WahCompleteRequest
WahCreateHandleContextTable
WahCreateNotificationHandle
WahCreateSocketHandle
WahDestroyHandleContextTable
WahDisableNonIFSHandleSupport
WahEnableNonIFSHandleSupport
WahEnumerateHandleContexts
WahInsertHandleContext
WahNotifyAllProcesses
WahOpenApcHelper
WahOpenCurrentThread
WahOpenHandleHelper
WahOpenNotificationHandleHelper
WahQueueUserApc
WahReferenceContextByHandle
WahRemoveHandleContext
WahWaitForNotification

Sections

.3V261i7
Size: - Virtual size: 80KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.7ft4wT5
Size: 35KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Wka8TO6
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE