D:\backup8-6-17\docs\GitHub\de4dot\de4dot.blocks\obj\Debug\de4dot.blocks.pdb
Static task
static1
Behavioral task
behavioral1
Sample
De4dotEx.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
De4dotEx.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
de4dot.blocks.dll
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
de4dot.blocks.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
dnlib.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
dnlib.dll
Resource
win10v2004-20240508-en
General
-
Target
5fd96eb92c0aa898f96291ade6dfa2e8_JaffaCakes118
-
Size
1.6MB
-
MD5
5fd96eb92c0aa898f96291ade6dfa2e8
-
SHA1
7c52da1a612edb4d90b253ce28bca6c3a43160fb
-
SHA256
5ce9f6184fabfa3a84be5d84d926011185a260f7d2d8163cf74c6cba4abd2669
-
SHA512
8bd70316c143751bd8a240c13488211455022c8b4a31d61b8544ad9d7ca8204168dfa12c740a0e2b88c53af0a18913a493828a54381a8cbb7f49ade0daa99e29
-
SSDEEP
49152:DXRSY4OMPwhoSyXx6ACE9LIBzVUC73cRHw:DXYFOMIhAkzExIBzVUmcJw
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/De4dotEx.exe unpack001/de4dot.blocks.dll unpack001/dnlib.dll
Files
-
5fd96eb92c0aa898f96291ade6dfa2e8_JaffaCakes118.rar
-
De4dotEx.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
LIa/_B Size: 811KB - Virtual size: 810KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-
de4dot.blocks.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
mscoree
_CorDllMain
Sections
.text Size: 163KB - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
dnlib.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
D:\backup8-6-17\docs\GitHub\dnlib\src\obj\Debug\dnlib.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 956B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ