Behavioral task
behavioral1
Sample
05e4126380db74a5dbdfb413b12ea831_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
05e4126380db74a5dbdfb413b12ea831_JaffaCakes118
-
Size
13KB
-
MD5
05e4126380db74a5dbdfb413b12ea831
-
SHA1
615e36d0f1de15f76c70b57c8995237e4f360e8f
-
SHA256
f13ac3b093b9d64ed16aa752a2b929b703bf6b922af768ab035a5b04649fa4a9
-
SHA512
19fb0e90f0201796cb843596f57214c37ce58393e5d06d52efc35663ff14cbac69c27aefd2c02cf0bbb8fc5c5fe5b483aca8df0dfc217a8d1f2708263c4d5573
-
SSDEEP
192:pYjF8dWHwOsw6JErKj3r79rvxN2aluP2zoNP/2VFOxYJtYgl6kVF:sadOhvGrrRvx/8l52VFCCtYgUkVF
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 05e4126380db74a5dbdfb413b12ea831_JaffaCakes118 unpack001/out.upx
Files
-
05e4126380db74a5dbdfb413b12ea831_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
UPX0 Size: - Virtual size: 28KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DDK0 Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ