L:\v5_vt_proj\Release\v5_mult_Launcher.pdb
Overview
overview
5Static
static
3Readme-??.htm
windows7-x64
1Readme-??.htm
windows10-2004-x64
1V5.exe
windows7-x64
1V5.exe
windows10-2004-x64
1v5_Log.dll
windows7-x64
5v5_Log.dll
windows10-2004-x64
5v5_Process...er.dll
windows7-x64
1v5_Process...er.dll
windows10-2004-x64
1v5_hook.dll
windows7-x64
1v5_hook.dll
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
Readme-??.htm
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
Readme-??.htm
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
V5.exe
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
V5.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
v5_Log.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
v5_Log.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
v5_Process_Manager.dll
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
v5_Process_Manager.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
v5_hook.dll
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
v5_hook.dll
Resource
win10v2004-20240508-en
General
-
Target
a5665d76d5fe5d45c496c8d222a561d9_JaffaCakes118
-
Size
397KB
-
MD5
a5665d76d5fe5d45c496c8d222a561d9
-
SHA1
a8c1e183709c6dce3c3e1069d8514e179ab2e19c
-
SHA256
017be333ec10872512480193b9897c054ef39fd8b7271ef7d7fc22a2fd0d9956
-
SHA512
fc48187639f04b9744a921fdda04ee634ecced5574d4534796631eb16214e1860fde8ca796f7b63073d642a6da3a592f86b6571de819b1008d9e6686ef87839b
-
SSDEEP
12288:+cpLvxlIxpYbG54LGrsGM59LimNC0Asiip4chD:+8Lvx6EGBvM59TE0rJhD
Malware Config
Signatures
-
Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/V5.exe unpack001/v5_Log.dll unpack001/v5_Process_Manager.dll unpack001/v5_hook.dll
Files
-
a5665d76d5fe5d45c496c8d222a561d9_JaffaCakes118.zip
-
Log/1.log
-
Log/2.log
-
Log/3.log
-
Log/4.log
-
Log/5.log
-
Readme-??.htm
-
V5.exe.exe windows:4 windows x86 arch:x86
fad646691f074cfaa0682078afe51f97
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
FindClose
FindFirstFileW
GetVolumeInformationW
GetFullPathNameW
SetErrorMode
FileTimeToLocalFileTime
GetFileAttributesW
GetFileTime
GetTickCount
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoW
ExitProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
RtlUnwind
RaiseException
HeapReAlloc
HeapSize
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DuplicateHandle
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
ReadFile
FileTimeToSystemTime
GetThreadLocale
lstrlenA
InterlockedIncrement
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
GlobalFlags
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetVersionExW
ResumeThread
GetCurrentThread
WriteProcessMemory
VirtualProtectEx
ReadProcessMemory
VirtualQueryEx
VirtualAllocEx
ConvertDefaultLocale
GetVersion
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
InterlockedExchange
InterlockedDecrement
WideCharToMultiByte
GlobalAlloc
FormatMessageW
LocalFree
lstrlenW
MulDiv
GetModuleHandleA
GlobalLock
GlobalUnlock
GlobalFree
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
LoadLibraryA
SetLastError
lstrcmpW
MultiByteToWideChar
GetVersionExA
DeleteFileW
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
SetUnhandledExceptionFilter
GetModuleFileNameA
FreeResource
WriteFile
SizeofResource
LockResource
LoadResource
FindResourceW
Process32NextW
Module32NextW
TerminateProcess
OpenProcess
Module32FirstW
Process32FirstW
CreateToolhelp32Snapshot
CreateProcessW
LoadLibraryW
GetEnvironmentStringsW
FreeLibrary
GetCurrentProcess
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateFileW
CloseHandle
GetModuleHandleW
GetProcAddress
GetLastError
CreateMutexW
GetModuleFileNameW
WritePrivateProfileStringW
ExpandEnvironmentStringsW
GetPrivateProfileStringW
HeapDestroy
user32
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
SetRect
IsRectEmpty
CopyAcceleratorTableW
CharNextW
CharUpperW
ReleaseCapture
SetCapture
UnregisterClassW
DestroyMenu
GetSysColorBrush
SetWindowContextHelpId
MapDialogRect
GetMessageW
TranslateMessage
ValidateRect
PostQuitMessage
GetCursorPos
WindowFromPoint
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
SetDlgItemTextW
GetDlgItemTextW
GetWindowThreadProcessId
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringW
DrawTextW
TabbedTextOutW
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamW
IsWindowEnabled
GetNextDlgTabItem
EndDialog
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
IsWindow
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageW
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
GetKeyState
SetForegroundWindow
IsWindowVisible
UpdateWindow
GetMenu
PostMessageW
GetSubMenu
GetMenuItemID
GetMenuItemCount
PostThreadMessageW
MessageBoxW
CreateWindowExW
GetClassInfoExW
RegisterClipboardFormatW
DrawTextExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
ScreenToClient
EqualRect
PtInRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetWindowLongW
SetWindowLongW
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
GetWindow
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
LoadIconW
DrawIcon
GetSystemMetrics
IsIconic
InvalidateRect
DrawFocusRect
GetFocus
CopyRect
GetClientRect
LoadCursorW
GetSysColor
SetCursor
GetParent
SendMessageW
EnableWindow
RegisterWindowMessageW
SetWindowsHookExW
UnregisterClassA
gdi32
GetStockObject
GetDeviceCaps
RectVisible
DeleteDC
CreateRectRgnIndirect
GetMapMode
GetBkColor
GetTextColor
GetRgnBox
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
CreateFontW
PtVisible
GetWindowExtEx
GetViewportExtEx
DeleteObject
SetMapMode
SetBkMode
RestoreDC
SaveDC
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
GetObjectW
GetTextExtentPoint32W
CreateFontIndirectW
TextOutW
comdlg32
GetFileTitleW
winspool.drv
DocumentPropertiesW
OpenPrinterW
ClosePrinter
advapi32
RegDeleteKeyW
LookupPrivilegeValueW
RegSetValueExW
RegCreateKeyExW
RegQueryValueW
RegEnumKeyW
OpenProcessToken
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyW
RegCloseKey
AdjustTokenPrivileges
shell32
ShellExecuteW
DragQueryFileW
DragFinish
SHCreateDirectoryExW
ord43
comctl32
_TrackMouseEvent
InitCommonControlsEx
shlwapi
PathFindFileNameA
PathMatchSpecW
PathAddBackslashW
PathFindExtensionW
PathStripToRootW
PathFindFileNameW
PathFileExistsW
PathIsUNCW
oledlg
OleUIBusyW
ole32
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
OleInitialize
CoRevokeClassObject
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitialize
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
oleaut32
SysAllocString
OleCreateFontIndirect
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy
VariantClear
VariantChangeType
VariantInit
SysAllocStringLen
SysStringLen
SysFreeString
dbghelp
MiniDumpWriteDump
Sections
.text Size: 232KB - Virtual size: 229KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 60KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
config.ini
-
v5_Log.dll.dll windows:4 windows x86 arch:x86
304aaf4345777e4c4e19ca12789fb9d3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
L:\v5_vt_proj\Release\v5_Log.pdb
Imports
kernel32
CreateEventW
CreateFileMappingW
CreateMutexW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
LoadResource
LockResource
SizeofResource
CloseHandle
Sleep
FindResourceW
GetModuleFileNameW
lstrcatW
FindResourceExW
FindFirstFileW
FindNextFileW
FindClose
MapViewOfFile
CreateThread
CreateDirectoryW
GetLastError
WaitForSingleObject
WriteFile
CreateFileW
SetEvent
UnmapViewOfFile
lstrcpyW
GetLocalTime
FlushFileBuffers
CreateFileA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
GetVersionExA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
RtlUnwind
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
LoadLibraryA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
advapi32
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
LookupAccountNameW
AllocateAndInitializeSid
FreeSid
shlwapi
PathFindFileNameW
PathFileExistsW
PathFindExtensionW
StrCmpIW
user32
UnregisterClassA
Sections
.text Size: 60KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 776B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
v5_Process_Manager.dll.dll windows:4 windows x86 arch:x86
f64c2582d3a0e5f411f2a56f12f92a54
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
L:\v5_vt_proj\Release\v5_Process_Manager.pdb
Imports
kernel32
WaitForMultipleObjects
GetSystemTimeAsFileTime
WaitForSingleObject
CreateThread
CloseHandle
CreateSemaphoreA
ReleaseSemaphore
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
HeapAlloc
GetLastError
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
RaiseException
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
HeapSize
ExitProcess
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
RtlUnwind
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
GetLocaleInfoA
InitializeCriticalSection
rpcrt4
RpcMgmtStopServerListening
RpcServerListen
RpcServerRegisterIf
RpcServerUseProtseqEpA
NdrServerCall2
RpcServerUnregisterIf
Sections
.text Size: 60KB - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 788B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
v5_hook.dll.dll windows:4 windows x86 arch:x86
828347ad5879457f882106eb20b0aaf6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
L:\v5_vt_proj\Release\v5_hook.pdb
Imports
kernel32
GetLocalTime
GetModuleFileNameW
GetCurrentThreadId
WaitForSingleObject
MapViewOfFile
LoadLibraryW
GetModuleFileNameA
TerminateProcess
ResumeThread
WaitNamedPipeW
EnterCriticalSection
VirtualProtectEx
GetThreadContext
UnmapViewOfFile
VirtualQuery
SuspendThread
VirtualFree
InitializeCriticalSection
Sleep
LeaveCriticalSection
FlushInstructionCache
VirtualAlloc
SetEvent
ReleaseMutex
OpenMutexW
OpenEventW
OpenFileMappingW
GetProcAddress
GetModuleHandleW
GetCurrentThread
GetEnvironmentVariableW
CloseHandle
GetLastError
GetCurrentProcess
GetCurrentProcessId
CreateFileA
SetStdHandle
GetConsoleOutputCP
WriteConsoleA
SetFilePointer
SetLastError
VirtualProtect
InterlockedCompareExchange
SetThreadContext
WriteProcessMemory
ReadProcessMemory
VirtualQueryEx
VirtualAllocEx
ExitProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
HeapFree
WriteConsoleW
GetFileType
GetStdHandle
GetCommandLineA
GetVersionExA
GetProcessHeap
RaiseException
RtlUnwind
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
DeleteCriticalSection
HeapReAlloc
HeapDestroy
HeapCreate
WriteFile
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetHandleCount
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LoadLibraryA
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
user32
wsprintfW
advapi32
LookupPrivilegeValueW
OpenProcessToken
FreeSid
LookupAccountNameW
SetEntriesInAclW
InitializeSecurityDescriptor
AllocateAndInitializeSid
SetSecurityDescriptorDacl
AdjustTokenPrivileges
shlwapi
PathFindFileNameW
rpcrt4
NdrClientCall2
RpcBindingFree
RpcStringFreeA
RpcBindingFromStringBindingA
RpcStringBindingComposeA
Exports
Exports
DetourMustNeedExport
Sections
.text Size: 140KB - Virtual size: 138KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 156KB - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 780B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ