msvcm80.i386.pdb
Behavioral task
behavioral1
Sample
mlang.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
mlang.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
msvcm80.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
msvcm80.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
Крутилка-капсул.v2.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
Крутилка-капсул.v2.exe
Resource
win10v2004-20240709-en
General
-
Target
37481c22c43099e92b7c161a143ee62f_JaffaCakes118
-
Size
300KB
-
MD5
37481c22c43099e92b7c161a143ee62f
-
SHA1
1cf6d8ff2b09ff4c126be866adc8f158c3017189
-
SHA256
45d2c19a5864796daa8b2fb306e0e82e200221cd87fbc6c27e78b39be2ef4aa3
-
SHA512
5df5c20100901a89ef79fab55ca6d00905cd8726b25a08163298ecf92ae769cb07205279bc49a4126eeda3e0168f8bc7699398dd1f19d2c50a9b734540d289ff
-
SSDEEP
6144:X/WsbP2GLHcxq+7q7B5zleQylb9KiLTzo1Q6VvoDz1q:X/r5cB7sDAbXLTU1Q6VAVq
Malware Config
Signatures
-
resource yara_rule static1/unpack001/mlang.dll vmprotect -
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/mlang.dll unpack001/msvcm80.dll unpack001/Крутилка-капсул.v2.exe
Files
-
37481c22c43099e92b7c161a143ee62f_JaffaCakes118.rar
-
mlang.dll.dll windows:4 windows x86 arch:x86
c04325c5e6789af05001e33a0a7a9e5e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetSystemTimeAsFileTime
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetSystemMetrics
advapi32
RegOpenKeyA
Sections
.text Size: - Virtual size: 150KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sxdata Size: - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 83KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 196KB - Virtual size: 193KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
msvcm80.dll.dll windows:4 windows x86 arch:x86
83e6ecedcb8a69cca8d85e1481140fa0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcr80
__clean_type_info_names_internal
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
__setusermatherr
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
?_query_new_handler@@YAP6AHI@ZXZ
signal
_invalid_parameter
_errno
_set_invalid_parameter_handler
_get_invalid_parameter_handler
?set_terminate@@YAP6AXXZP6AXXZ@Z
_get_terminate
_set_purecall_handler
_get_purecall_handler
?set_unexpected@@YAP6AXXZP6AXXZ@Z
_get_unexpected
_fpieee_flt
_cexit
strcpy_s
strlen
_exit
_XcptFilter
_endthread
_freefls
___fls_setvalue@8
___fls_getvalue@4
__get_flsindex
__set_flsgetvalue
_dosmaperr
_initptd
calloc
_endthreadex
memcpy_s
wcslen
memcmp
memchr
memmove_s
memset
??_V@YAXPAX@Z
_malloc_crt
_invoke_watson
_CxxThrowException
??2@YAPAXI@Z
__CxxUnregisterExceptionObject
__CxxDetectRethrow
__CxxRegisterExceptionObject
__CxxExceptionFilter
__CxxQueryExceptionSize
abort
fgetc
fputc
ungetc
fflush
setvbuf
fwrite
fgetpos
fseek
fsetpos
fclose
__iob_func
fgetwc
fputwc
ungetwc
localeconv
??_U@YAPAXI@Z
realloc
setlocale
strcspn
_strtoi64
_strtoui64
sprintf_s
_Gettnames
_Strftime
_Getdays
_Getmonths
___lc_handle_func
strtod
__crtGetStringTypeW
__pctype_func
___mb_cur_max_l_func
___lc_codepage_func
__crtLCMapStringW
__crtCompareStringA
___lc_collate_cp_func
__crtLCMapStringA
memcpy
__crtCompareStringW
_fsopen
wcstombs_s
_wfsopen
_get_osplatform
mbstowcs_s
fputs
__uncaught_exception
isupper
islower
towlower
towupper
strcmp
__FrameUnwindFilter
tolower
isspace
isdigit
isalnum
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
??3@YAXPAX@Z
_ui64toa_s
_create_locale
malloc
_free_locale
_invalid_parameter_noinfo
free
kernel32
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
MultiByteToWideChar
GetLocaleInfoA
CreateThread
ResumeThread
GetLastError
ExitThread
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
ole32
CoCreateInstance
mscoree
CorBindToRuntimeEx
_CorDllMain
Exports
Exports
?DoCallBackInDefaultDomain@<CrtImplementationDetails>@@YAXP6GJPAX@Z0@Z
?DoDllLanguageSupportValidation@<CrtImplementationDetails>@@YAXXZ
?RegisterModuleUninitializer@<CrtImplementationDetails>@@YAXP$AAVEventHandler@System@@@Z
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@@Z
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@P$AAVException@3@@Z
?ThrowNestedModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVException@System@@0@Z
?_Addstd@ios_base@std@@SAXPAV12@@Z
?_Atexit@@YAXP6AXXZ@Z
?_BADOFF_func@std@@YAABJXZ
?_Cerr_func@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@XZ
?_Cin_func@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@1@XZ
?_Clocptr_func@_Locimp@locale@std@@CAAAPAV123@XZ
?_Clog_func@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@XZ
?_Cosh@@YANNN@Z
?_Cout_func@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@XZ
?_Debug_message@std@@YAXPBD0@Z
?_Dnorm@@YAFPAG@Z
?_Dscale@@YAFPANJ@Z
?_Dtentox@@YANNJPAH@Z
?_Dtest@@YAFPAN@Z
?_Dunscale@@YAFPAFPAN@Z
?_Exp@@YAFPANNF@Z
?_FCosh@@YAMMM@Z
?_FDnorm@@YAFPAG@Z
?_FDscale@@YAFPAMJ@Z
?_FDtentox@@YAMMJPAH@Z
?_FDtest@@YAFPAM@Z
?_FDunscale@@YAFPAFPAM@Z
?_FExp@@YAFPAMMF@Z
?_FSinh@@YAMMM@Z
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Fiopen@std@@YAPAU_iobuf@@PBGHH@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?_Fpz_func@std@@YAAA_JXZ
?_Getcoll@@YA?AU_Collvec@@XZ
?_Getctype@@YA?AU_Ctypevec@@XZ
?_Getcvt@@YA?AU_Cvtvec@@XZ
?_Getdateorder@@YAHXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Getwctype@@YAFGPBU_Ctypevec@@@Z
?_Getwctype@@YAF_WPBU_Ctypevec@@@Z
?_Getwctypes@@YAPBGPBG0PAFPBU_Ctypevec@@@Z
?_Getwctypes@@YAPB_WPB_W0PAFPBU_Ctypevec@@@Z
?_Id_cnt_func@id@locale@std@@CAAAHXZ
?_Id_func@?$codecvt@GDH@std@@SAAAVid@locale@2@XZ
?_Id_func@?$codecvt@_WDH@std@@SAAAVid@locale@2@XZ
?_Id_func@?$ctype@D@std@@SAAAVid@locale@2@XZ
?_Id_func@?$ctype@G@std@@SAAAVid@locale@2@XZ
?_Id_func@?$ctype@_W@std@@SAAAVid@locale@2@XZ
?_Index_func@ios_base@std@@CAAAHXZ
?_Init@locale@std@@CAPAV_Locimp@12@XZ
?_Init_cnt_func@Init@ios_base@std@@CAAAHXZ
?_Init_ctor@Init@ios_base@std@@CAXPAV123@@Z
?_Init_dtor@Init@ios_base@std@@CAXPAV123@@Z
?_Init_locks_ctor@_Init_locks@std@@CAXPAV12@@Z
?_Init_locks_dtor@_Init_locks@std@@CAXPAV12@@Z
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
?_LCosh@@YAOOO@Z
?_LDscale@@YAFPAOJ@Z
?_LDtentox@@YAOOJPAH@Z
?_LDtest@@YAFPAO@Z
?_LDunscale@@YAFPAFPAO@Z
?_LExp@@YAFPAOOF@Z
?_LPoly@@YAOOPBOH@Z
?_LSinh@@YAOOO@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z
?_Locimp_ctor@_Locimp@locale@std@@CAXPAV123@ABV123@@Z
?_Locimp_dtor@_Locimp@locale@std@@CAXPAV123@@Z
?_Locinfo_Addcats@_Locinfo@std@@SAAAV12@PAV12@HPBD@Z
?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@HPBD@Z
?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z
?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z
?_Lockit_ctor@_Lockit@std@@CAXPAV12@@Z
?_Lockit_ctor@_Lockit@std@@CAXPAV12@H@Z
?_Lockit_ctor@_Lockit@std@@SAXH@Z
?_Lockit_dtor@_Lockit@std@@CAXPAV12@@Z
?_Lockit_dtor@_Lockit@std@@SAXH@Z
?_Makeloc@_Locimp@locale@std@@CAPAV123@ABV_Locinfo@3@HPAV123@PBV23@@Z
?_Makeushloc@_Locimp@locale@std@@CAXABV_Locinfo@3@HPAV123@PBV23@@Z
?_Makewloc@_Locimp@locale@std@@CAXABV_Locinfo@3@HPAV123@PBV23@@Z
?_Makexloc@_Locimp@locale@std@@CAXABV_Locinfo@3@HPAV123@PBV23@@Z
?_Mbrtowc@@YAHPAGPBDIPAHPBU_Cvtvec@@@Z
?_Mbrtowc@@YAHPA_WPBDIPAHPBU_Cvtvec@@@Z
?_Mtxdst@@YAXPAU_RTL_CRITICAL_SECTION@@@Z
?_Mtxinit@@YAXPAU_RTL_CRITICAL_SECTION@@@Z
?_Mtxlock@@YAXPAU_RTL_CRITICAL_SECTION@@@Z
?_Mtxunlock@@YAXPAU_RTL_CRITICAL_SECTION@@@Z
?_Mutex_Lock@_Mutex@std@@CAXPAV12@@Z
?_Mutex_Unlock@_Mutex@std@@CAXPAV12@@Z
?_Mutex_ctor@_Mutex@std@@CAXPAV12@@Z
?_Mutex_dtor@_Mutex@std@@CAXPAV12@@Z
?_Nomemory@std@@YAXXZ
?_Once@@YAXPAJP6AXXZ@Z
?_Poly@@YANNPBNH@Z
?_Setgloballocale@locale@std@@CAXPAX@Z
?_Sinh@@YANNN@Z
?_Stod@@YANPBDPAPADJ@Z
?_Stodx@@YANPBDPAPADJPAH@Z
?_Stof@@YAMPBDPAPADJPAH@Z
?_Stoflt@@YAHPBD0PAPADQAJH@Z
?_Stofx@@YAMPBDPAPADJPAH@Z
?_Stold@@YAOPBDPAPADJPAH@Z
?_Stoldx@@YAOPBDPAPADJPAH@Z
?_Stolx@@YAJPBDPAPADHPAH@Z
?_Stopfx@@YAHPAPBDPAPAD@Z
?_Stoul@@YAKPBDPAPADH@Z
?_Stoulx@@YAKPBDPAPADHPAH@Z
?_Stoxflt@@YAHPBD0PAPADQAJH@Z
?_Strcoll@@YAHPBD000PBU_Collvec@@@Z
?_Strxfrm@@YAIPAD0PBD1PBU_Collvec@@@Z
?_Sync_func@ios_base@std@@CAAA_NXZ
?_Throw@std@@YAXABVexception@stdext@@@Z
?_Tolower@@YAHHPBU_Ctypevec@@@Z
?_Toupper@@YAHHPBU_Ctypevec@@@Z
?_Towlower@@YAGGPBU_Ctypevec@@@Z
?_Towlower@@YA_W_WPBU_Ctypevec@@@Z
?_Towupper@@YAGGPBU_Ctypevec@@@Z
?_Towupper@@YA_W_WPBU_Ctypevec@@@Z
?_Wcerr_func@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@1@XZ
?_Wcerr_func@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@XZ
?_Wcin_func@std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@1@XZ
?_Wcin_func@std@@YAAAV?$basic_istream@_WU?$char_traits@_W@std@@@1@XZ
?_Wclog_func@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@1@XZ
?_Wclog_func@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@XZ
?_Wcout_func@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@1@XZ
?_Wcout_func@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@XZ
?_Wcrtomb@@YAHPADGPAHPBU_Cvtvec@@@Z
?_Wcrtomb@@YAHPAD_WPAHPBU_Cvtvec@@@Z
?_Wcscoll@@YAHPBG000PBU_Collvec@@@Z
?_Wcscoll@@YAHPB_W000PBU_Collvec@@@Z
?_Wcsxfrm@@YAIPAG0PBG1PBU_Collvec@@@Z
?_Wcsxfrm@@YAIPA_W0PB_W1PBU_Collvec@@@Z
?_Xfsopen@std@@YAPAU_iobuf@@PB_W0H@Z
?_Xinvarg@_String_base@std@@SAXXZ
?_Xlen@_String_base@std@@SAXXZ
?_Xran@_String_base@std@@SAXXZ
?__Stodx@@YANPBDPAPADJPAH@Z
?__Stofx@@YAMPBDPAPADJPAH@Z
?__Stoldx@@YAOPBDPAPADJPAH@Z
?__Wcrtomb_lk@@YAHPAD_WPAHPBU_Cvtvec@@@Z
?__get_default_appdomain@@YAJPAPAUIUnknown@@@Z
?__query_new_handler_m@@YAP6MHI@ZXZ
?__release_appdomain@@YAXPAUIUnknown@@@Z
?_beginthread@@YAIP6MXPAX@ZI0@Z
?_beginthreadex@@YAIPAXIP6MI0@Z0IPAI@Z
?_fpieee_flt@@YAHKPAU_EXCEPTION_POINTERS@@P6MHPAU_FPIEEE_RECORD@@@Z@Z
?_set_invalid_parameter_handler@@YAP6AXPB_W00II@ZH@Z
?_set_invalid_parameter_handler@@YAP6MXPB_W00II@ZP6MX000II@Z@Z
?_set_new_handler@@YAP6MHI@ZP6MHI@Z@Z
?_set_purecall_handler@@YAP6AXXZH@Z
?_set_purecall_handler@@YAP6MXXZP6MXXZ@Z
?_uncaught_exception_m@std@@YA_NXZ
?classic@locale@std@@SAABV12@XZ
?empty@locale@std@@SA?AV12@XZ
?facet_Register@facet@locale@std@@CAXPAV123@@Z
?global@locale@std@@SA?AV12@ABV12@@Z
?resetiosflags@std@@YA?AU?$_Smanip@H@1@H@Z
?set_new_handler@std@@YAP6MXXZP6MXXZ@Z
?set_terminate@@YAP6MXXZP6MXXZ@Z
?set_unexpected@@YAP6MXXZP6MXXZ@Z
?setbase@std@@YA?AU?$_Smanip@H@1@H@Z
?setiosflags@std@@YA?AU?$_Smanip@H@1@H@Z
?setprecision@std@@YA?AU?$_Smanip@H@1@H@Z
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
?signal@@YAP6MXH@ZHH@Z
?signal@@YAP6MXH@ZHP6MXH@Z@Z
__setusermatherr_m
towctrans
wctrans
wctype
Sections
.text Size: 160KB - Virtual size: 158KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 280KB - Virtual size: 278KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 976B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Крутилка-капсул.v2.exe.exe windows:4 windows x86 arch:x86
c25b41cc84d60162b093c835f580ea08
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
wsprintfA
ReleaseDC
OemToCharA
MessageBoxA
GetSystemMetrics
GetDC
GetAsyncKeyState
FindWindowA
kernel32
lstrcpyW
lstrlenW
lstrlenA
lstrcpynA
lstrcpyA
lstrcmpiA
CloseHandle
CopyFileA
CreateDirectoryA
CreateFileA
CreateFileMappingA
CreateMutexA
CreateProcessA
CreateThread
DeleteFileA
ExitProcess
FindClose
FindFirstFileA
FindNextFileA
FindResourceA
FreeLibrary
FreeResource
GetComputerNameA
GetComputerNameW
GetDiskFreeSpaceExA
GetDriveTypeA
GetEnvironmentVariableA
GetFileSize
GetLastError
GetLocalTime
GetLocaleInfoA
GetLogicalDrives
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileSectionNamesA
GetPrivateProfileStringA
GetProcAddress
GetProcessHeap
GetSystemDefaultLangID
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatusEx
HeapAlloc
HeapFree
LoadLibraryA
LoadResource
LockResource
MapViewOfFile
MoveFileExA
MultiByteToWideChar
OpenProcess
ReadFile
RtlMoveMemory
RtlZeroMemory
SetCurrentDirectoryA
SetEndOfFile
SetErrorMode
SetFileAttributesA
SetFilePointer
SizeofResource
Sleep
UnmapViewOfFile
VerLanguageNameA
VirtualAlloc
VirtualFree
WideCharToMultiByte
WriteFile
lstrcatA
lstrcatW
lstrcmpA
gdi32
GetDeviceCaps
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 228KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 384B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE