F1122
Behavioral task
behavioral1
Sample
44bca4965cb94d1f1c6895c383db59e0_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
44bca4965cb94d1f1c6895c383db59e0_JaffaCakes118
-
Size
176KB
-
MD5
44bca4965cb94d1f1c6895c383db59e0
-
SHA1
7f92b251d808731065e561245dcc1a619ccf3fa5
-
SHA256
dd9f27a61aaf065629f624e2eaa0bc8a2a2b97b16e3beba4031e6517cf558a3c
-
SHA512
585629dc71401406f74d26f2ad9b8660f0f1f7f5615c71ade215462655b07cf6f853fb60ab739093a8c873f3bbfa43c86014d155196cd70faf88ce3325b9da9b
-
SSDEEP
3072:Y3IO8EliWQDbozyO46f+Ze7sl4e4yWjQU2dRO8PGZFbhjnFGRttVG+vKjeouts1:YYElFgAyqiSsl4ekjQUM6Bn0w3KoS
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 44bca4965cb94d1f1c6895c383db59e0_JaffaCakes118
Files
-
44bca4965cb94d1f1c6895c383db59e0_JaffaCakes118.dll windows:6 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 132KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 172KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE