C:\Source RenewalPT\SrcGame\src\Release\Game.pdb
Behavioral task
behavioral1
Sample
Game.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Game.exe
Resource
win10v2004-20240426-en
General
-
Target
8beb772305da2dd283336345f4583f97_JaffaCakes118
-
Size
2.1MB
-
MD5
8beb772305da2dd283336345f4583f97
-
SHA1
7788d1873dfbcf1ddf92302e800f59fc910fe241
-
SHA256
8089d4496834e041c475cfbea834211ab5fe67359b2fda8ec4dd107f4606582a
-
SHA512
7c8cda22781cc0ce1277ff9cf19df91f36ee531a80d8206d2d52544eeaab4f10cd799ada5e9c60c219ca03f7390d257ac43fe1a021b71af35be767ef36224954
-
SSDEEP
49152:3L25yU+BYsp8fRSooPpdNjHJc81j3q2dZ7z/khSho7PEnhNmvS:3L2MU+ugSRLapzH71jXdZ3/QShnDES
Malware Config
Signatures
-
Detect Lumma Stealer payload V4 1 IoCs
resource yara_rule static1/unpack001/Game.exe family_lumma_v4 -
Lumma family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Game.exe
Files
-
8beb772305da2dd283336345f4583f97_JaffaCakes118.zip
-
Game.exe.exe windows:6 windows x86 arch:x86
a6957d051e11846d25d8b562cfb8eb2c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
dsound
ord1
kernel32
GetPrivateProfileStringA
CreateDirectoryA
WriteFile
OutputDebugStringA
GetCurrentDirectoryA
CreateProcessA
WritePrivateProfileStringA
SetFilePointer
VirtualProtect
VirtualQuery
GlobalAlloc
GetTickCount64
GetComputerNameA
SuspendThread
ResumeThread
CopyFileA
WaitForSingleObject
SetThreadPriority
TerminateThread
GetExitCodeThread
_lopen
_lcreat
_lread
_lwrite
_lclose
CompareFileTime
GlobalUnlock
GlobalLock
GlobalHandle
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
IsDBCSLeadByte
LocalAlloc
LocalFree
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
TerminateProcess
GetVersionExA
SetEndOfFile
HeapSize
CreateFileW
SetStdHandle
OutputDebugStringW
SetConsoleCtrlHandler
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
CreateThread
FindNextFileW
FindFirstFileExW
FindNextFileA
HeapReAlloc
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
HeapAlloc
HeapFree
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
RaiseException
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
SetLastError
DecodePointer
EncodePointer
FormatMessageW
GetLastError
InitializeSListHead
GetSystemTimeAsFileTime
FindClose
ExitProcess
GetFileSize
ReadFile
FindFirstFileA
lstrcmpiA
lstrcmpA
lstrcatA
ExitThread
GetCurrentThread
Sleep
Module32Next
Module32First
Thread32Next
Thread32First
GetCurrentProcessId
GetCurrentProcess
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
QueryPerformanceCounter
WriteConsoleW
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
CreateToolhelp32Snapshot
lstrlenA
lstrcpyA
lstrcpynA
LoadLibraryA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
FreeLibraryAndExitThread
GetTickCount
OpenThread
GetPrivateProfileIntA
GetTimeZoneInformation
InitializeCriticalSection
DuplicateHandle
CloseHandle
IsDebuggerPresent
GetLocalTime
DeleteFileA
CreateFileA
GetCurrentThreadId
IsValidCodePage
user32
SetMenu
LoadMenuA
CheckMenuItem
EnableMenuItem
SetForegroundWindow
CreateMenu
GetMenu
LoadIconA
DestroyIcon
SetWindowPos
GetAsyncKeyState
AdjustWindowRect
SetWindowLongA
CharToOemA
OemToCharA
CharUpperA
GetWindowTextA
FindWindowA
GetSystemMetrics
wsprintfA
CharLowerA
EnumWindows
GetClassNameA
GetDC
ReleaseDC
SetWindowTextA
GetClientRect
ClientToScreen
OffsetRect
SendMessageA
GetKeyState
MessageBoxA
LoadKeyboardLayoutA
GetKeyboardLayoutNameA
TranslateMessage
DispatchMessageA
PeekMessageA
DefWindowProcA
PostQuitMessage
PostMessageA
CallWindowProcA
SetFocus
GetForegroundWindow
AdjustWindowRectEx
ShowCursor
GetWindowLongA
SetTimer
GetWindow
RegisterClassA
CreateWindowExA
DestroyWindow
ShowWindow
CreateDialogParamA
GetDlgItem
WaitMessage
UpdateWindow
LoadCursorA
gdi32
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCA
DeleteDC
DeleteObject
GetDIBits
SelectObject
GetObjectA
SetBkMode
GetStockObject
SetTextColor
GetTextColor
CreateSolidBrush
BitBlt
advapi32
RegCloseKey
RegCreateKeyExA
RegDeleteValueA
RegOpenKeyA
shell32
ShellExecuteA
Shell_NotifyIconA
ole32
CoCreateInstance
CoUninitialize
CoInitialize
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateFontA
D3DXCreateTextureFromFileInMemoryEx
D3DXGetImageInfoFromFileInMemory
winmm
mmioClose
timeBeginPeriod
mmioWrite
mmioGetInfo
mmioSetInfo
mmioOpenA
timeEndPeriod
timeKillEvent
mixerGetControlDetailsA
timeSetEvent
timeGetTime
mmioRead
mmioAdvance
mmioDescend
mmioAscend
mmioCreateChunk
mixerGetDevCapsA
mixerOpen
mixerClose
mixerGetLineInfoA
mixerGetLineControlsA
mixerSetControlDetails
mmioSeek
shlwapi
PathFileExistsA
msvfw32
ICDecompress
ICSendMessage
ICClose
ICLocate
avifil32
AVIStreamInfoA
AVIStreamOpenFromFileA
AVIStreamRelease
AVIStreamRead
AVIFileExit
AVIStreamLength
AVIStreamReadFormat
AVIFileInit
wininet
InternetOpenUrlA
InternetCloseHandle
InternetReadFile
HttpQueryInfoA
InternetOpenA
iphlpapi
GetAdaptersInfo
wsock32
closesocket
ioctlsocket
WSACleanup
accept
bind
connect
inet_ntoa
htons
inet_addr
select
__WSAFDIsSet
WSAAsyncSelect
WSAGetLastError
WSAStartup
gethostname
gethostbyname
socket
setsockopt
send
recv
listen
imm32
ImmSetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListA
ImmGetDescriptionA
ImmGetCompositionStringA
ImmReleaseContext
ImmGetContext
ImmGetProperty
ImmGetCandidateListCountA
Sections
.text Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 524KB - Virtual size: 523KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.2MB - Virtual size: 97.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ