EnableDebugPriv
war3
Static task
static1
Behavioral task
behavioral1
Sample
trqlzjmogj/war3.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
trqlzjmogj/war3.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
trqlzjmogj/新云软件.url
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
trqlzjmogj/新云软件.url
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
trqlzjmogj/魔兽争霸显血工具.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
trqlzjmogj/魔兽争霸显血工具.exe
Resource
win10v2004-20240709-en
Target
5d20e4106ec98b2edfd575a4cae3c6bb_JaffaCakes118
Size
90KB
MD5
5d20e4106ec98b2edfd575a4cae3c6bb
SHA1
8062c8880523516f1eaa10e2f9e0f90d2276248f
SHA256
8d0685eb6af60f910fd2ba0610ce27a43e543137446e85a720af842971e2985c
SHA512
5c5263e03dda410b39af409169d577ff189fa6891955341cb8c3d3284ce78f96431fac8d2a00110722fb7a5b18aad5ca426af2d7ffb8d74f62c931e96cca44f5
SSDEEP
1536:7RkaQHEQRUuZy317eZeSeKKPHqAdBp2cKGqIuRjDDDHbcWeXm1O1yuI3Tysa:g+qZeSIqmp2FGCDDDHb/XeUTyR
Checks for missing Authenticode signature.
resource |
---|
unpack001/trqlzjmogj/war3.dll |
unpack001/trqlzjmogj/魔兽争霸显血工具.exe |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetStringTypeW
GetCurrentProcess
LCMapStringW
LCMapStringA
OpenProcess
WriteProcessMemory
GetStringTypeA
CloseHandle
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
MultiByteToWideChar
RtlUnwind
MessageBoxA
GetWindowThreadProcessId
FindWindowA
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
EnableDebugPriv
war3
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
EVENT_SINK_GetIDsOfNames
_CIcos
_adj_fptan
__vbaVarVargNofree
__vbaFreeVar
__vbaLateIdCall
ord588
__vbaStrVarMove
__vbaLenBstr
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
EVENT_SINK_Invoke
__vbaRaiseEvent
__vbaFreeObjList
ord516
__vbaStrErrVarCopy
ord517
_adj_fprem1
__vbaRecAnsiToUni
ord518
ord519
__vbaI2Abs
__vbaForEachCollAd
__vbaVarCmpNe
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
Zombie_GetTypeInfo
__vbaAryDestruct
__vbaLateMemSt
__vbaVarForInit
__vbaExitProc
__vbaOnError
__vbaObjSet
ord595
_adj_fdiv_m16i
ord597
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
ord599
__vbaBoolVar
__vbaStrFixstr
ord520
__vbaFpR8
__vbaBoolVarNull
_CIsin
ord631
__vbaErase
__vbaChkstk
ord526
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
__vbaVarTstEq
__vbaI2I4
DllFunctionCall
__vbaVarOr
__vbaFpUI1
__vbaCastObjVar
__vbaRedimPreserve
_adj_fpatan
__vbaLateIdCallLd
Zombie_GetTypeInfoCount
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
ord600
__vbaUI1I2
_CIsqrt
__vbaObjIs
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaExceptHandler
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaFailedFriend
ord608
__vbaFPException
ord717
ord319
__vbaStrVarVal
__vbaUbound
__vbaVarCat
__vbaCheckType
__vbaI2Var
ord644
ord645
_CIlog
__vbaErrorOverflow
__vbaInStr
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord681
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaAryLock
ord320
__vbaVarDup
__vbaStrToAnsi
ord321
__vbaFpI2
ord616
__vbaFpI4
__vbaLateMemCallLd
ord617
_CIatan
__vbaI2ErrVar
__vbaCastObj
__vbaStrMove
_allmul
__vbaLenVarB
__vbaLateIdSt
_CItan
__vbaNextEachCollAd
__vbaAryUnlock
__vbaVarForNext
_CIexp
__vbaFreeObj
__vbaFreeStr
ord581
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ