RunDllHostCallBack
Static task
static1
Behavioral task
behavioral1
Sample
538e6af0330d0e5249a6b26399679997_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
538e6af0330d0e5249a6b26399679997_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
538e6af0330d0e5249a6b26399679997_JaffaCakes118
-
Size
282KB
-
MD5
538e6af0330d0e5249a6b26399679997
-
SHA1
7a85bacb58d5af755916037b404c36a4ce6c79c5
-
SHA256
db8681fa3e2c1d5f553d643a005ed3b64be3a7a101b20d8f074cd4be54d41d9e
-
SHA512
a60ddff71f956ad79a19e1fd6eb40c2335e6aa3e85ee2c5aa89ca259b223d714a4586c9ca0bb4f0b3fcb314b9ae48b016981c5a5b9efef887ff6f5083da705d5
-
SSDEEP
6144:7Nbdc014kr52BpIu+iIIFlewc+Y/3JGP+HHebdVG:xbdc0R24u+c3gJGdRVG
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 538e6af0330d0e5249a6b26399679997_JaffaCakes118
Files
-
538e6af0330d0e5249a6b26399679997_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
.packed Size: - Virtual size: 768KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 282KB - Virtual size: 299KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE