Static task
static1
Behavioral task
behavioral1
Sample
123/vpn.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
123/vpn.exe
Resource
win10v2004-20240508-en
General
-
Target
182f54a0354ebe138697d686e0fcea29_JaffaCakes118
-
Size
5KB
-
MD5
182f54a0354ebe138697d686e0fcea29
-
SHA1
a62f5158df616c5711cde2074e64d679fb3ccaac
-
SHA256
846d85af945f9959afe48bd1c91276de138ce1ae83df715d7416d6cf3c8ddcd1
-
SHA512
d8bce856e3db1d5937d30d725663518c9f1f7aa43e70e713dcc5241bc92beaba7144677ec73aa045668eba2bf84b20323968a0fe33992d4fd78037d5e0c3b183
-
SSDEEP
96:/d6cw+OvUw4gRRHATVVKWEv/z+SeD2izDRsymZecPOlFYHC7hQ7yfVrAcEwx8wyR:/xGMP8BAT2NT+SeNnmYcPuWHC93fVTfO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/123/vpn.exe
Files
-
182f54a0354ebe138697d686e0fcea29_JaffaCakes118.rar
-
123/vpn.exe.exe windows:5 windows x86 arch:x86
8553c56c31191f3ef5b3b58b43809b90
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
StrRetToBufW
rasapi32
RasGetErrorStringW
RasSetEntryPropertiesW
rasdlg
RasDialDlgW
imagehlp
MapFileAndCheckSumW
shell32
ord155
SHGetFolderPathW
SHGetFolderLocation
CommandLineToArgvW
SHGetDesktopFolder
SHGetMalloc
kernel32
GetCommandLineW
GetFullPathNameW
SetCurrentDirectoryW
LocalFree
GetPrivateProfileStructW
GetPrivateProfileStringW
GetFileAttributesExW
HeapFree
GetLastError
GetModuleFileNameW
GetModuleHandleW
HeapAlloc
GetProcessHeap
FormatMessageW
CompareStringW
lstrlenW
ExitProcess
user32
GetActiveWindow
wsprintfW
MessageBoxW
advapi32
OpenServiceW
CloseServiceHandle
QueryServiceConfigW
QueryServiceStatusEx
StartServiceW
ChangeServiceConfigW
OpenSCManagerW
ole32
CoUninitialize
CoFreeUnusedLibraries
CoCreateInstance
CoInitialize
CoTaskMemFree
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 356B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
123/vpn.ini