F1122
Behavioral task
behavioral1
Sample
52b3809b5d46e19e7fe7b2810cc99840_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
52b3809b5d46e19e7fe7b2810cc99840_JaffaCakes118
-
Size
159KB
-
MD5
52b3809b5d46e19e7fe7b2810cc99840
-
SHA1
d9f5302f73eef05d12d303dd8640b70857eed933
-
SHA256
d8fd3e4ff2a0498f567579233ec4ebfc100e7c5cb51ae0b5864db6a64198db25
-
SHA512
041945cb4f0074c9d9c4703dc3ace8fdc5ef377992ca93a9345ec754ad025bde38758ddfcd6c177b8c3a124f0fb15cd743d80a3af541b9d902759433dbff8815
-
SSDEEP
3072:GRUNwbDM1pdr6TFwu+oAeXs35jG62+G0fFW/yX36fAEFzeu7MFYIG2doutu19:S/9LAe835jN2+KKX3gCLG0oSY
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 52b3809b5d46e19e7fe7b2810cc99840_JaffaCakes118
Files
-
52b3809b5d46e19e7fe7b2810cc99840_JaffaCakes118.dll windows:7 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 124KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 155KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE