getpara
Behavioral task
behavioral1
Sample
f65a0eb9077cf5464d93c37248121d62_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
f65a0eb9077cf5464d93c37248121d62_JaffaCakes118
-
Size
261KB
-
MD5
f65a0eb9077cf5464d93c37248121d62
-
SHA1
c22d822627f8798d70e109a0eae1669bc4eadace
-
SHA256
16474ff478916b74e99e020db0f4555ae1563dbbfefa61b7b85165c513d9e5d8
-
SHA512
62a70a4e6fffb7b7f94802790646eda8fda81088bbdfbed08dcf09b3e532125599960d436b476c48bb2efe78120b1a88761606faef3b1a27b1f1b3c0578cb504
-
SSDEEP
6144:dC8J45y5ZVTPBw1A9EcpO12aK8xNe2G60qWM6O6I5dwtS:s8J0yPpE0dt2GzI5qS
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f65a0eb9077cf5464d93c37248121d62_JaffaCakes118
Files
-
f65a0eb9077cf5464d93c37248121d62_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 584KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 259KB - Virtual size: 260KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE