DllMain@12
VoidFunc
Overview
overview
10Static
static
10ReF4784752...38.lnk
windows7-x64
10ReF4784752...38.lnk
windows10-2004-x64
10dll32_dec.dll
windows7-x64
1dll32_dec.dll
windows10-2004-x64
1dll64_dec.dll
windows7-x64
1dll64_dec.dll
windows10-2004-x64
1dllb.dll
windows7-x64
5dllb.dll
windows10-2004-x64
5script.ps1
windows7-x64
3script.ps1
windows10-2004-x64
3Static task
static1
Behavioral task
behavioral1
Sample
ReF4784752863741938.lnk
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ReF4784752863741938.lnk
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
dll32_dec.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
dll32_dec.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
dll64_dec.dll
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
dll64_dec.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
dllb.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
dllb.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
script.ps1
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
script.ps1
Resource
win10v2004-20240611-en
Target
b1203983f8c428cc85a815fb175eacce_JaffaCakes118
Size
5.1MB
MD5
b1203983f8c428cc85a815fb175eacce
SHA1
83600a5f0603aaf226e01a5a126de3464da2af4c
SHA256
3dfa964a1885365a7ead7bec7c8c643af64aabe34a3393d2d12692fd872ff369
SHA512
6c1b6426dfdb698e3af971abc59983d2e0f9d6a733b340fa91b3a1e6560e8f329b6361868eaa57092dd129c43bb49ffe40ed7fdbd11e374d7f532986febdbb4b
SSDEEP
98304:qGINSlxGsV/iklr0r5H+2pbf1xu2l0oEpE9pQKMcL/gEM7VaXZMUwjg:QSlxGs29VpHu2GDE/NT4tcMU6g
https://sepogy.epiain.com/v2/loader.dll
Checks for missing Authenticode signature.
resource |
---|
unpack001/dll32_dec.dll |
unpack001/dll64_dec.dll |
unpack001/dllb.dll |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetNativeSystemInfo
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetThreadLocale
GetTickCount
HeapAlloc
HeapFree
InitializeCriticalSection
IsBadReadPtr
LeaveCriticalSection
LoadLibraryA
QueryPerformanceCounter
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
lstrlenA
__dllonexit
_amsg_exit
_initterm
_iob
_lock
_onexit
_stricmp
_unlock
_wcsnicmp
abort
calloc
free
fwrite
malloc
mbstowcs
realloc
strlen
strncmp
strtol
vfprintf
wcstombs
DllMain@12
VoidFunc
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetNativeSystemInfo
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetThreadLocale
GetTickCount
HeapAlloc
HeapFree
InitializeCriticalSection
IsBadReadPtr
LeaveCriticalSection
LoadLibraryA
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
lstrlenA
__dllonexit
__iob_func
_amsg_exit
_initterm
_lock
_onexit
_stricmp
_unlock
_wcsnicmp
abort
calloc
free
fwrite
malloc
mbstowcs
memcpy
realloc
signal
strlen
strncmp
strtol
vfprintf
wcstombs
DllMain
VoidFunc
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
cryptui.pdb
malloc
GetVersion
GetVersionExW
GetVersionExA
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
A_SHAFinal
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
WinVerifyTrustEx
CryptMsgVerifyCountersignatureEncoded
SetRect
CharUpperBuffW
SysAllocString
GetDeviceCaps
UuidToStringA
NetGetDCName
ord16
VerQueryValueW
PathUndecorateW
AlphaBlend
WTSSendMessageW
ACUIProviderInvokeUI
CryptUIDlgCertMgr
CryptUIDlgFreeCAContext
CryptUIDlgSelectCA
CryptUIDlgSelectCertificateA
CryptUIDlgSelectCertificateFromStore
CryptUIDlgSelectCertificateW
CryptUIDlgSelectStoreA
CryptUIDlgSelectStoreW
CryptUIDlgViewCRLA
CryptUIDlgViewCRLW
CryptUIDlgViewCTLA
CryptUIDlgViewCTLW
CryptUIDlgViewCertificateA
CryptUIDlgViewCertificatePropertiesA
CryptUIDlgViewCertificatePropertiesW
CryptUIDlgViewCertificateW
CryptUIDlgViewContext
CryptUIDlgViewSignerInfoA
CryptUIDlgViewSignerInfoW
CryptUIFreeCertificatePropertiesPagesA
CryptUIFreeCertificatePropertiesPagesW
CryptUIFreeViewSignaturesPagesA
CryptUIFreeViewSignaturesPagesW
CryptUIGetCertificatePropertiesPagesA
CryptUIGetCertificatePropertiesPagesW
CryptUIGetViewSignaturesPagesA
CryptUIGetViewSignaturesPagesW
CryptUIStartCertMgr
CryptUIViewExpiringCerts
CryptUIWizBuildCTL
CryptUIWizCertRequest
CryptUIWizCreateCertRequestNoDS
CryptUIWizDigitalSign
CryptUIWizExport
CryptUIWizFreeCertRequestNoDS
CryptUIWizFreeDigitalSignContext
CryptUIWizImport
CryptUIWizQueryCertRequestNoDS
CryptUIWizSubmitCertRequestNoDS
DllRegisterServer
DllUnregisterServer
EnrollmentCOMObjectFactory_getInstance
I_CryptUIProtect
I_CryptUIProtectFailure
LocalEnroll
LocalEnrollNoDS
RetrievePKCS7FromCA
WizardFree
`�O��M$��6�s���)�\�;��EE���� �M�������>��h_j����!��կ������m߰�����gĄ�B�|�H��7 �� �K���� "Ns���5��Ѯ�k� ��8M7���5�-��'�%��d�O���,A/���"%��X�ɐ��γ�,�_�n=$&"L�wΐN1j������\�Ku ��MԷ��bx�(��jS���cJjz_���k4�1v���̱a Kz�ep��������"=�O-�11�<<�?����W�O��&��j��%{���b����[l�3;>���d%*t�#-F?,��@����spo�D v</�gޏj�k��×!,=>l+A��r��d%}���:�s��� ��������x��(aBW$��>l`��o�A�KTi�0�W�=Ø���N)�j8ڱ��e��!#DE8P��>�!�4��Pn~x1����Ps����Y�W�%����xC�o�Hz/O��&W�|�x"n�@����]����{[0v�G���i�m���{�g�0��N���[:lm_(� ��ӽI����3d���[���b.;�#��wk*\�n;]�Mw�lV���L6��z���!eq*���n�U���+�F<����E��aŨ�Z&RȼG뉲�<��-�B�|�����L��el)�xUe(ck/5�ϷY��&Jq������x�ac��;�c�~��u|��B��/�Ŧ��zr�;ѫ�Tּ_b�(Ffw���xTq]m*���H� ~Ϸ���h�+-ְ�������\�o{����ǔX�)P$���3�c�>"3O�m�@�`�;q�x���Ɉ� , ����2"e�47�ឹA���KGB&�yc*��'�؊ɭ�B��1 ��F��n_��ء ��`���j�H�p�Gݶ�J�s>�ʔ�D\�; qs@^�����'9��M�#v�����V�h�xbz8���G��u�(؆�&�����r b!`�Ͳ�m}��� �&�m��p����6_�[��r�X�� t�Q%��'����V���&�e�i̪�iBScW1HwA�b0/}bjp��kc�6� nBP�9���k�F��01i��(�[?��%0��ܲH �O&l��r��GV��aKj/�&Ql+` �r��T�V���ƛ�<��F�k|0�#��C�Sk�o��=��1��{�������r��w���E�]8s��Г�;�E���)��W5�*�{qz�� ���"o;�i�z�����v)������j�Y���<�TN8X�#��Vc�v܀��V��\��lq)2H��OX��d��<jK�v&*���Ui�~q���, eL��sT�%- �92���������36����f�hW���ըeN?��� ��: ��xS��|):��k9>}w�7��ɣ��i�.��{�.�g�Z�X��ڄ��B�0%?J���νS��b��"w�dѵ)ʰ<�|1�מW�_��kE������oA����\�g�N�SP�_,�<3���qE�^Ӵ��;n�8�mڦ����e����Hk�J�pKֵ�%���$[ΑC���%���tH��/ B ���+L�9<K��Z�dMC�b[,]l�r��-@��(���Ƃě���-8�n?��#q��T��}��J�+!��V����v�����'1%�,��U�%�:y���+���k!i>�&˺�Z���DH�% �l�v�����k�f�o�݇9�7"@=��z[V[9��"C4����O��بV˰+��%�D�]�S�V���s�k"���<V�Q���ه�������� �:x�����d݆��OO�C@��ioz���'`�Y��!��x���CK�c���&��K^ϟ���ԅc)~�b�����i>?]�"S1j�[��J��;ţ�(j�_ЗhY*:��;����~��D �z)VT�E����@mÖ^�|U< fb��<>:r�Dݣ���p�6�z.^+2�����%K�^S�ty����g�#����(&C�L���� 4M_�et��{���'ڳn�x/����8�D���m�u��Q|7*'����_¯͆�&9uY/�(f"��?�0��?E5X�;��]ވdYە����Mu�T[`Z��7A*��FX<d�G4��!�UU���)yd���?jh;B;�˔��Z��6ʞ�'O� ����+H�y�zj��G� 'D����u$~L�� �7y�x�ުu���D!�C�������>�d1����p��$��1b.���>]����e0-�@�N��+@�v�l)[Wk�)�/��/ы����-8�s�?�����YX�O���3%1ف�FVE���^�S�����H��8cG��;,"0$J|H�����ad������{p| �qn�E.B�k��N�uͪ��ŗ ��B���5nc�.�_':�ωv4�/8�E.�"�� ���a6�lhA3��+݅��DẺ4H��p�l�����"���tY��d�bܤ��@���:0����Zh���-ݮ��0��[�����y �`��[=1��Q����t5�?�s�l��Z�(Ql[�'���m� �0���0�Ǒ�c�-Ç�@B���� J�b������Y�4�_�|,��T��N5�S�"w�;�P�:��a�`�HM��tz ��kQ��4��:��L`[t[eSʷ�����¯K?�Eci q_Ʈ]�c��Ph�wE3��q�]:B�_Ec���<L��� 둰��<v��9��]�'�&���+=D��B�_�͔��$�}N�JB<�워ꂉ"���ۼ�n�ڡjiJQ�Hᰋ�'��K�Ѓs�q�S������u�w]Rrz@���y]Aa_�����CAW3��zJݽ�F�v~u��Q6kȭs?�]r��>��m�'��b����22�¯a��r��5���In��][!��T�'5?�7��{�h��� 0F�/�vf��i���]�\�蠃YSW~���N+әFI����� n�}�T���Xe ��V����a-��s�JG e:��ꜚwj����*��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ