blah
Behavioral task
behavioral1
Sample
544ede6037b513842318d76f466337b0_JaffaCakes118.dll
Resource
win7-20240729-en
General
-
Target
544ede6037b513842318d76f466337b0_JaffaCakes118
-
Size
16KB
-
MD5
544ede6037b513842318d76f466337b0
-
SHA1
9d5351cb9e3023bae29e6d0611dbb8b26f60fab2
-
SHA256
0efc49a89d040e507f367f1295aec4d37f5b6c48196a4dc7279f5ba5a7adf315
-
SHA512
30801b9f731217825095dc069ea4138304bee2b0fbc9dd24aeb92f2442363353fca275019d476b752b08eec4908aad44048c945a52856ae413fa87989aaf2f26
-
SSDEEP
384:Eg/9m7f9OzuPlMco4F5hAK8gAEOK4/vGzpSApA:KfAzBco0TAK8dEVSvGzz6
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 544ede6037b513842318d76f466337b0_JaffaCakes118 unpack001/out.upx
Files
-
544ede6037b513842318d76f466337b0_JaffaCakes118.dll windows:5 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.dll windows:5 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.text Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ