Behavioral task
behavioral1
Sample
2e014f3837b7e1e7342273e66fdf2d22_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
2e014f3837b7e1e7342273e66fdf2d22_JaffaCakes118
-
Size
162KB
-
MD5
2e014f3837b7e1e7342273e66fdf2d22
-
SHA1
1e0858f785e516872f04463443ce6b98982fbff5
-
SHA256
7693d5ac05b03425ed3327e73c7633ac260e1433a81373f1e73170145b3595b6
-
SHA512
cea432bc922ac419d401a960886887798c70e01629dbc6d6488f03ec92680aef79d7cd96dcb5946d9a2a114d262bdbe658bd86ba34cc6463f2effb8fea73df2f
-
SSDEEP
3072:3ExSxZZExzcWsAWqbk+M/UCHPqEH0ffdJjLG9vIDyr5QsTaJ6a7+IL4X4+:3nhWsAdbb8UCvn0zLG9DVTGDxL4I+
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 2e014f3837b7e1e7342273e66fdf2d22_JaffaCakes118 unpack001/out.upx
Files
-
2e014f3837b7e1e7342273e66fdf2d22_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
UPX0 Size: - Virtual size: 20KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 84KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.text Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 69KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ