456f8bc05e54621c857f013aaad94c9e_JaffaCakes118

General

Target

456f8bc05e54621c857f013aaad94c9e_JaffaCakes118
Size

131KB
MD5

456f8bc05e54621c857f013aaad94c9e
SHA1

0fab3946fdd69ff134f39bef38d59375778ab54a
SHA256

7dec9b1f3a56e65b26b724f0df4a77f47ac8c99407d2e98b40d7da93ec431718
SHA512

03929db4369c38c314370d2e87a8b4d09c8e6a6b93c6f06a23a06da45ad6bda543cdab0d9e7cf2dbc80447a060f860f4a8d0cc21f6c6402f327b4f885935b111
SSDEEP

3072:ndbQBHHNePNATDQ437C+q2r5O3hYttBKvnqhgoutLQs:db+HGx437s2w3hYttB2qhgoS

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
456f8bc05e54621c857f013aaad94c9e_JaffaCakes118

Files

456f8bc05e54621c857f013aaad94c9e_JaffaCakes118
.dll windows:8 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

WlxActivateUserShell
WlxDisplayLockedNotice
WlxDisplaySASNotice
WlxDisplayStatusMessage
WlxGetConsoleSwitchCredentials
WlxGetStatusMessage
WlxInitialize
WlxIsLockOk
WlxIsLogoffOk
WlxLoggedOnSAS
WlxLoggedOutSAS
WlxLogoff
WlxNegotiate
WlxNetworkProviderLoad
WlxRemoveStatusMessage
WlxScreenSaverNotify
WlxShutdown
WlxStartApplication
WlxWkstaLockedSAS
wlDesktopIconCount
wlDisableDesktopIcon
wlDisableItem
wlDisableKey
wlDisableMessage
wlDisableMouseArea
wlEnableAutologin
wlExit
wlExitWindows
wlGetDisabledKey
wlGetDisabledMessage
wlGetItemHandle
wlGetKeyState
wlInstallDwl
wlIs64BitWindows
wlIsAdmin
wlIsDwlInstalled
wlIsItemDisabled
wlIsKeyDisabled
wlIsKeyReplaced
wlIsMessageDisabled
wlIsNTSystem
wlMapScancode
wlNeedDwlInstall
wlReplaceKey
wlRestoreAll
wlRestoreDesktopIcons
wlRunMethod
wlSendKeyDown
wlSendKeyUp
wlSetKeyCallback
wlSetKeyPostMessage
wlSetKeySendMessage
wlSetKeyState
wlSetShutdownCallback
wlSetStartMenu
wlStrToVk
wlUninstallDwl
wlVersion
wlVkToStr
wlWinVersion
wlWriteReg

Sections

UPX0
Size: - Virtual size: 180KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 121KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 180KB

UPX1 Size: 121KB - Virtual size: 124KB

.rsrc Size: 9KB - Virtual size: 12KB

UPX0
Size: - Virtual size: 180KB

UPX1
Size: 121KB - Virtual size: 124KB

.rsrc
Size: 9KB - Virtual size: 12KB