Behavioral task
behavioral1
Sample
443ed6faf7f48fafff27f0c3f931d4a4_JaffaCakes118.dll
Resource
win7-20241010-en
General
-
Target
443ed6faf7f48fafff27f0c3f931d4a4_JaffaCakes118
-
Size
12KB
-
MD5
443ed6faf7f48fafff27f0c3f931d4a4
-
SHA1
f2d78cad8cc10efc25a2e94cffa8e16e82da6f02
-
SHA256
b61d7e833d9f4bff1d2b79fb95d036e8a7aac90131462d00bfd0bedc8fe33fe8
-
SHA512
9c5d96646b2185bd93c1d504fe96cb2a9bb419f20775f266121f4507913522e2549bb3e6f734b03d3f3daa313e30bb4dbd7cafd3c8445bcf8fc1a202848cf06d
-
SSDEEP
384:+NQng5vio019wm3aFanoS94yhVXrn97AydVG1+Ki:+cg5U9wm3VnoS9hBnBpVCb
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 443ed6faf7f48fafff27f0c3f931d4a4_JaffaCakes118 unpack001/out.upx
Files
-
443ed6faf7f48fafff27f0c3f931d4a4_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
UPX0 Size: - Virtual size: 28KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ