Static task
static1
Behavioral task
behavioral1
Sample
d2mr.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d2mr.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
d2mr.exe
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
d2mr.exe
Resource
win10v2004-20240419-en
General
-
Target
0b5f2310a62ac61148e396e3028f97dc_JaffaCakes118
-
Size
1.5MB
-
MD5
0b5f2310a62ac61148e396e3028f97dc
-
SHA1
44f2bf471fb17810bd6d0af10a4b2a0669ccfb45
-
SHA256
25fb2163dfbd8c9fc9b0451293865d3a1656390be906896a6c6bf3d64647c011
-
SHA512
64db53ad76871580f48e246150c66909b5686677fd390cb87eaa13eb8057157efc260429c843a0c81061ff8105bf0c95a1b382d9713486b7d3d03327eb8a4147
-
SSDEEP
24576:JIc0QAqXtBaMzHnei/saWYNG/7pllzoKgqf7q6hO1KxK3xtnn/24mIfhapNG/7pa:Gc0QAqXPaonM/V3E0EfDn/dfMm/Va
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/d2mr.dll unpack001/d2mr.exe
Files
-
0b5f2310a62ac61148e396e3028f97dc_JaffaCakes118.zip
-
d2mr.dll.dll windows:4 windows x86 arch:x86
437058fbe47ac144c5fc043861496ba7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
SuspendThread
GetCurrentThreadId
GetProcAddress
LoadLibraryA
ResumeThread
GetCurrentProcessId
Thread32Next
Thread32First
CreateToolhelp32Snapshot
GetCommandLineA
GetModuleHandleA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
WideCharToMultiByte
HeapDestroy
HeapCreate
VirtualFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
HeapFree
VirtualAlloc
FlushFileBuffers
CloseHandle
SetStdHandle
SetFilePointer
SuspendThread
GetCurrentThreadId
GetProcAddress
LoadLibraryA
ResumeThread
GetCurrentProcessId
Thread32Next
Thread32First
CreateToolhelp32Snapshot
GetCommandLineA
GetModuleHandleA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
WideCharToMultiByte
HeapDestroy
HeapCreate
VirtualFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
HeapFree
VirtualAlloc
FlushFileBuffers
CloseHandle
SetStdHandle
SetFilePointer
Sections
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 819B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
d2mr.exe.exe windows:4 windows x86 arch:x86
a9ca27ce8da1416b37881e6546121704
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualAlloc
HeapAlloc
HeapFree
SetFilePointer
WriteFile
RtlUnwind
VirtualFree
HeapCreate
HeapDestroy
LoadLibraryA
GetStdHandle
SetHandleCount
GetOEMCP
GetACP
GetCPInfo
WideCharToMultiByte
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
OpenProcess
GetModuleHandleA
GetProcAddress
GetLastError
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
WaitForSingleObject
VirtualFreeEx
GetModuleFileNameA
GetCurrentProcess
CloseHandle
GetFileType
Module32Next
Module32First
CreateToolhelp32Snapshot
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
MultiByteToWideChar
GetStringTypeW
VirtualAlloc
HeapAlloc
HeapFree
SetFilePointer
WriteFile
RtlUnwind
VirtualFree
HeapCreate
HeapDestroy
LoadLibraryA
GetStdHandle
SetHandleCount
GetOEMCP
GetACP
GetCPInfo
WideCharToMultiByte
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
OpenProcess
GetModuleHandleA
GetProcAddress
GetLastError
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
WaitForSingleObject
VirtualFreeEx
GetModuleFileNameA
GetCurrentProcess
CloseHandle
GetFileType
Module32Next
Module32First
CreateToolhelp32Snapshot
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
MultiByteToWideChar
GetStringTypeW
user32
PostQuitMessage
GetSystemMetrics
GetDC
ReleaseDC
BeginPaint
EndPaint
DefWindowProcA
DestroyWindow
InvalidateRect
IsWindowVisible
GetWindowTextA
GetWindowThreadProcessId
EnumWindows
MessageBoxA
LoadIconA
LoadCursorA
RegisterClassA
CreateWindowExA
ShowWindow
UpdateWindow
SetTimer
GetMessageA
TranslateMessage
DispatchMessageA
gdi32
CreateCompatibleDC
CreateCompatibleBitmap
PatBlt
BitBlt
SetBkColor
SelectObject
Rectangle
TextOutA
CreateFontA
CreateSolidBrush
CreatePen
GetStockObject
DeleteDC
SetTextColor
advapi32
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
Sections
.text Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 952B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
data/global/excel/arena.bin
-
data/global/excel/armor.bin
-
data/global/excel/armtype.bin
-
data/global/excel/automagic.bin
-
data/global/excel/automap.bin
-
data/global/excel/belts.bin
-
data/global/excel/bodylocs.bin
-
data/global/excel/books.bin
-
data/global/excel/charstats.bin
-
data/global/excel/chartemplate.bin
-
data/global/excel/colors.bin
-
data/global/excel/compcode.bin
-
data/global/excel/composit.bin
-
data/global/excel/cubemain.bin
-
data/global/excel/difficultylevels.bin
-
data/global/excel/elemtypes.bin
-
data/global/excel/events.bin
-
data/global/excel/experience.bin
-
data/global/excel/gamble.bin
-
data/global/excel/gems.bin
-
data/global/excel/hiredesc.bin
-
data/global/excel/hireling.bin
-
data/global/excel/hitclass.bin
-
data/global/excel/inventory.bin
-
data/global/excel/itemratio.bin
-
data/global/excel/itemscode.bin
-
data/global/excel/itemstatcost.bin
-
data/global/excel/itemtypes.bin
-
data/global/excel/leveldefs.bin
-
data/global/excel/levels.bin
-
data/global/excel/levels.txt
-
data/global/excel/lowqualityitems.bin
-
data/global/excel/lvlmaze.bin
-
data/global/excel/lvlprest.bin
-
data/global/excel/lvlsub.bin
-
data/global/excel/lvltypes.bin
-
data/global/excel/lvlwarp.bin
-
data/global/excel/magicprefix.bin
-
data/global/excel/magicsuffix.bin
-
data/global/excel/misc.bin
-
data/global/excel/misscalc.bin
-
data/global/excel/misscode.bin
-
data/global/excel/missiles.bin
-
data/global/excel/monai.bin
-
data/global/excel/monequip.bin
-
data/global/excel/monitempercent.bin
-
data/global/excel/monlvl.bin
-
data/global/excel/monmode.bin
-
data/global/excel/monplace.bin
-
data/global/excel/monpreset.bin
-
data/global/excel/monprop.bin
-
data/global/excel/monseq.bin
-
data/global/excel/monsounds.bin
-
data/global/excel/monstats.bin
-
data/global/excel/monstats2.bin
-
data/global/excel/montype.bin
-
data/global/excel/monumod.bin
-
data/global/excel/npc.bin
-
data/global/excel/objects.bin
-
data/global/excel/objgroup.bin
-
data/global/excel/objmode.bin
-
data/global/excel/objtype.bin
-
data/global/excel/overlay.bin
-
data/global/excel/pettype.bin
-
data/global/excel/playerclass.bin
-
data/global/excel/plrmode.bin
-
data/global/excel/plrtype.bin
-
data/global/excel/properties.bin
-
data/global/excel/qualityitems.bin
-
data/global/excel/rareprefix.bin
-
data/global/excel/raresuffix.bin
-
data/global/excel/runes.bin
-
data/global/excel/setitems.bin
-
data/global/excel/sets.bin
-
data/global/excel/shrines.bin
-
data/global/excel/skillcalc.bin
-
data/global/excel/skilldesc.bin
-
data/global/excel/skilldesccode.bin
-
data/global/excel/skills.bin
-
data/global/excel/skillscode.bin
-
data/global/excel/sounds.bin
-
data/global/excel/states.bin
-
data/global/excel/storepage.bin
-
data/global/excel/superuniques.bin
-
data/global/excel/treasureclassex.bin
-
data/global/excel/uniqueappellation.bin
-
data/global/excel/uniqueitems.bin
-
data/global/excel/uniqueprefix.bin
-
data/global/excel/uniquesuffix.bin
-
data/global/excel/uniquetitle.bin
-
data/global/excel/weapons.bin
-
data/local/font/kor/font16.DC6
-
data/local/font/kor/font42.DC6
-
data/local/font/kor/font6.DC6
-
data/local/font/kor/fontingamechat.DC6