r77 | a99bf0bb4bc510f1e666901fb5be5eb2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
a99bf0bb4bc510f1e666901fb5be5eb2_JaffaCakes118
Size 753KB
Sample240614-pcltestern
SHA256 42f3d0002035557254c90f9ac386ec33b071fbddab84394d23bba3baedc1ce9d
MD5 a99bf0bb4bc510f1e666901fb5be5eb2
SHA1 0c9dfd7cc52869a91a611d0b00833a23ceec6576
SHA512 79b5a11ca1a3d4765d2512ac0a13be0a7acc7e6c3c95835d18959a303bc80371253c5f008b446e45a3ad65f719f1c6383b33b06440a0374419b59914fd218d8c
SSDEEP 12288:q4/s+5IKO1bvGPFmm0eE1gTYO2OrMh4X683i280l3f7qBMyz1lq+I/sKw:q4ZiXbvSmLebYYS783i280l3f7S9Zlqg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

r77

Malware Config

Signatures

R77 family
r77

r77 rootkit payload 1 IoCs

Detects the payload of the r77 rootkit.

resource	yara_rule
static1/unpack001/Monster Hunter World v20200109 Plus 22 Trainer.exe	r77_payload

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Monster Hunter World v20200109 Plus 22 Trainer.exe

File Explorer

a99bf0bb4bc510f1e666901fb5be5eb2_JaffaCakes118

.rar 753KB
Monster Hunter World v20200109 Plus 22 Trainer.exe

.exe 1.8MB

a99bf0bb4bc510f1e666901fb5be5eb2_JaffaCakes118

SHA256 42f3d0002035557254c90f9ac386ec33b071fbddab84394d23bba3baedc1ce9d
MD5 a99bf0bb4bc510f1e666901fb5be5eb2
SHA1 0c9dfd7cc52869a91a611d0b00833a23ceec6576
SHA512 79b5a11ca1a3d4765d2512ac0a13be0a7acc7e6c3c95835d18959a303bc80371253c5f008b446e45a3ad65f719f1c6383b33b06440a0374419b59914fd218d8c
SSDEEP 12288:q4/s+5IKO1bvGPFmm0eE1gTYO2OrMh4X683i280l3f7qBMyz1lq+I/sKw:q4ZiXbvSmLebYYS783i280l3f7S9Zlqg
MD5 SHA1 SHA512 SSDEEP

Monster Hunter World v20200109 Plus 22 Trainer.exe

IMPHASH 42e7985dc7e204ee48513f36ec01f373
SHA256 4af609033a4b4c1bef11548482437c9aac48175cb285c9a2957a2e973bbc200b
MD5 233df3e84b92511fc5b5180a8c12471a
SHA1 4e2e6c88c44ad2f74d0fdf23ea828130eec453f5
SHA512 7a7a507a4671b42661f175df6686cb79fbdf1843cb063d876f3d3a2f74cbe22965c57e3ddb8a4f83b30e60ffc9365765a88578abd4c30e25c047172d06be55bf
SSDEEP 24576:KUXjsa+GK5834bgd0CYosMBXeOxkUZfIdaR0hW/boeynEKA/mcIyFnDSfWB:j+Gafg6CCMVeOxbZxkWjInW/lbF
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

r77 rootkit payload

Detects the payload of the r77 rootkit.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

178232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

UnmapViewOfFile Sleep CloseHandle LoadLibraryW GetProcAddress GetCurrentProcessId CreateFileMappingW MapViewOfFile ReadFile WritePrivateProfileStringW WriteFile CreateFileW GetModuleHandleA GetPrivateProfileStringW GetLastError LoadLibraryA WaitNamedPipeW SizeofResource LockResource LoadResource FindResourceW GetModuleHandleW GetModuleFileNameW GetFileAttributesW MultiByteToWideChar FreeLibrary LoadLibraryExW CreateDirectoryW GetTempPathW GetCurrentProcess IsWow64Process SetLastError WaitForSingleObject ResumeThread WriteConsoleW HeapSize GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation HeapReAlloc SetStdHandle GetFullPathNameW GetCurrentDirectoryW EnumSystemLocalesW GetUserDefaultLCID WideCharToMultiByte GetStringTypeW EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId DuplicateHandle WaitForSingleObjectEx SwitchToThread GetCurrentThread GetExitCodeThread InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount EncodePointer DecodePointer QueryPerformanceCounter GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead LocalFree CreateTimerQueue SetEvent SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetVersionExW VirtualAlloc VirtualProtect VirtualFree ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwindEx RtlPcToFileHeader RaiseException ExitProcess GetModuleHandleExW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitThread GetStdHandle SetFilePointerEx HeapAlloc HeapFree FlushFileBuffers GetConsoleCP GetConsoleMode IsValidLocale

user32

MessageBoxA MessageBoxW

shell32

SHGetFolderPathW

oleaut32

SafeArrayAccessData SafeArrayCreateVector SafeArrayCreate SafeArrayUnaccessData SafeArrayDestroy

mscoree

CLRCreateInstance CorBindToRuntime

wininet

InternetOpenA InternetReadFile InternetOpenUrlA

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

winmm

PlaySoundW