Behavioral task
behavioral1
Sample
eedfdf81b04bd432293b68ab4c6d752d_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
eedfdf81b04bd432293b68ab4c6d752d_JaffaCakes118
-
Size
225KB
-
MD5
eedfdf81b04bd432293b68ab4c6d752d
-
SHA1
9e1b3ed88ce949c491f1a0dc734e277c65762091
-
SHA256
69354e31a96b82c0bf7acf01233e2080aad7362c9208afb577c22c3eaaa45e29
-
SHA512
35f4556d926c83356f141cdbbfb47ac5b903dafbb3b4c54f93f29329819c57aa4c57f3861c9b294781c8aec4e9cef4e5af5501d29ea92c9bc4fab5ed54e59670
-
SSDEEP
6144:K46xVPmiY2E2bckJX4oiGaB4gNKwIf72FicI6n+EJY1:KPxRmAjbckt4LB48OfdHEJY1
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx
Files
-
eedfdf81b04bd432293b68ab4c6d752d_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
Code Sign
45:c3:1d:c3:29:94:f0:1a:5c:17:2f:b7:32:3e:ee:1d:96:af:ea:7aSigner
Actual PE Digest45:c3:1d:c3:29:94:f0:1a:5c:17:2f:b7:32:3e:ee:1d:96:af:ea:7aDigest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
UPX0 Size: - Virtual size: 368KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 210KB - Virtual size: 212KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE