fadc8031d30eca49b10a3643cfffd359_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fadc8031d30eca49b10a3643cfffd359_JaffaCakes118
Size

39KB
MD5

fadc8031d30eca49b10a3643cfffd359
SHA1

7ba7738ab0a053d8263473de08e9cd80a4513c7c
SHA256

c87d70a1bc279e3919939dc0e4d1be4b8dc3788631c658d224a88754f6a23c50
SHA512

d601d455b877eb6483ed78aebbfbae65f1f3dea00e36f4b1a463b21b7c05d470d9ffb03d719f1619e8443c9c7554dbeb3e2ee6ca309f308cd3eaf1be1326ec6f
SSDEEP

768:xdW1Izo5pLdejrkvdw0gZNFAkLlsOKanbcuyD7UiPP9I:xdW1qo5ju6G0U3lsOKanouy8iPPi

Score

7^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fadc8031d30eca49b10a3643cfffd359_JaffaCakes118

Files

fadc8031d30eca49b10a3643cfffd359_JaffaCakes118
.dll windows:0 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

WahCloseApcHelper
WahCloseHandleHelper
WahCloseNotificationHandleHelper
WahCloseSocketHandle
WahCloseThread
WahCompleteRequest
WahCreateHandleContextTable
WahCreateNotificationHandle
WahCreateSocketHandle
WahDestroyHandleContextTable
WahDisableNonIFSHandleSupport
WahEnableNonIFSHandleSupport
WahEnumerateHandleContexts
WahInsertHandleContext
WahNotifyAllProcesses
WahOpenApcHelper
WahOpenCurrentThread
WahOpenHandleHelper
WahOpenNotificationHandleHelper
WahQueueUserApc
WahReferenceContextByHandle
WahRemoveHandleContext
WahWaitForNotification

Sections

.3V261i7
Size: - Virtual size: 80KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.7ft4wT5
Size: 35KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Wka8TO6
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE