D:\Projects\Interception\bin\Release\Interception.pdb
Static task
static1
Behavioral task
behavioral1
Sample
IML.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
IML.dll
Resource
win10v2004-20240508-en
General
-
Target
5fdb8a1ff7950bda4b2e6fdd0f9575fd_JaffaCakes118
-
Size
326KB
-
MD5
5fdb8a1ff7950bda4b2e6fdd0f9575fd
-
SHA1
01c84f372851d0892d30d261f91d8df68cad3742
-
SHA256
06d999aa2b190eac491edf0e83f20c730b0eff0f49dabd77fdd74448aa713aa5
-
SHA512
d174ce135eae92129438a60dbaecb96cea457d5e51cb0089ef46af1ae3b90b65d86a6dae3c983ddff4e4d396d4baa1b4d7fb841e65203ae8b3ace72afa706664
-
SSDEEP
6144:ungNXdRelTzVc5j9MtPn0orRZjQth6ryexyfTLSD6cKfcLPF:XAzVcN9MtP0orvsth6ryridN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/IML.dll
Files
-
5fdb8a1ff7950bda4b2e6fdd0f9575fd_JaffaCakes118.zip
-
IML.dll.dll windows:6 windows x86 arch:x86
215e727746e81d3b243855401889e396
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
urlmon
URLDownloadToFileA
d3dx9_43
D3DXCreateTextureFromFileInMemory
kernel32
CreateDirectoryA
WritePrivateProfileStringA
GetPrivateProfileStringA
FreeLibraryAndExitThread
DisableThreadLibraryCalls
CreateThread
GetTickCount
VirtualFree
VirtualAlloc
VirtualQuery
HeapCreate
VirtualProtect
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
CloseHandle
HeapAlloc
GetThreadContext
GetProcAddress
GetCurrentProcessId
FlushInstructionCache
SetThreadContext
OpenThread
MultiByteToWideChar
GetModuleHandleA
GlobalLock
GlobalUnlock
GlobalAlloc
GlobalFree
QueryPerformanceFrequency
FindFirstFileA
FindNextFileA
FindClose
CreateFileW
FindFirstFileExW
GetFileAttributesExW
GetFileInformationByHandle
AreFileApisANSI
GetLastError
SetLastError
GetModuleHandleW
WideCharToMultiByte
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
QueryPerformanceCounter
InitializeSListHead
LeaveCriticalSection
EnterCriticalSection
GetSystemTimeAsFileTime
user32
SetCursor
LoadCursorA
ClientToScreen
SetWindowLongA
GetClipboardData
SetCursorPos
GetForegroundWindow
MessageBoxA
EmptyClipboard
GetCursorPos
ScreenToClient
GetClientRect
GetKeyState
OpenClipboard
SetClipboardData
CallWindowProcA
IsChild
CloseClipboard
shell32
SHGetFolderPathA
msvcp140
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?uncaught_exception@std@@YA_NXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?_Xinvalid_argument@std@@YAXPBD@Z
?__ExceptionPtrCreate@@YAXPAX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrToBool@@YA_NPBX@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?_XGetLastError@std@@YAXXZ
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
_Mtx_trylock
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
_Xtime_get_ticks
_Thrd_sleep
_Query_perf_frequency
_Query_perf_counter
?_Xout_of_range@std@@YAXPBD@Z
?_Winerror_message@std@@YAKKPADK@Z
?_Winerror_map@std@@YAHH@Z
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
imm32
ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
vcruntime140
__std_terminate
memmove
memcpy
memchr
__std_type_info_destroy_list
_CxxThrowException
__std_exception_destroy
strstr
_purecall
__CxxFrameHandler3
__std_exception_copy
memset
_except_handler4_common
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_errno
exit
terminate
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
api-ms-win-crt-stdio-l1-1-0
_fseeki64
fsetpos
fwrite
fread
fgetc
ungetc
__stdio_common_vsscanf
__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vsprintf
_wfopen
fputc
_get_stream_buffer_pointers
setvbuf
fclose
__stdio_common_vsprintf_s
fopen_s
ftell
fseek
fgetpos
fflush
api-ms-win-crt-convert-l1-1-0
atof
strtoul
atoi
strtol
api-ms-win-crt-filesystem-l1-1-0
remove
_unlock_file
_lock_file
api-ms-win-crt-utility-l1-1-0
qsort
rand
api-ms-win-crt-string-l1-1-0
strncpy
isprint
isdigit
strncmp
towlower
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
free
api-ms-win-crt-math-l1-1-0
_libm_sse2_sin_precise
_libm_sse2_pow_precise
_CIatan2
ceil
_CIfmod
_hypotf
floor
_libm_sse2_sqrt_precise
_libm_sse2_cos_precise
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
Sections
.text Size: 435KB - Virtual size: 434KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 138KB - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Interception/-Night_Legit.ini