__GetExceptDLLinfo
___CPPdebugHook
Overview
overview
7Static
static
7inoz2/01-INFO/01.htm
windows7-x64
1inoz2/01-INFO/01.htm
windows10-2004-x64
1inoz2/01-INFO/02.htm
windows7-x64
1inoz2/01-INFO/02.htm
windows10-2004-x64
1inoz2/02-A...01.htm
windows7-x64
1inoz2/02-A...01.htm
windows10-2004-x64
1inoz2/02-A...02.htm
windows7-x64
1inoz2/02-A...02.htm
windows10-2004-x64
1inoz2/02-A...32.bat
windows7-x64
1inoz2/02-A...32.bat
windows10-2004-x64
1inoz2/02-A...g0.exe
windows7-x64
1inoz2/02-A...g0.exe
windows10-2004-x64
1inoz2/02-A...UP.bat
windows7-x64
1inoz2/02-A...UP.bat
windows10-2004-x64
1inoz2/02-A...KE.bat
windows7-x64
1inoz2/02-A...KE.bat
windows10-2004-x64
1inoz2/02-A...SM.bat
windows7-x64
1inoz2/02-A...SM.bat
windows10-2004-x64
1inoz2/02-A...G0.exe
windows7-x64
3inoz2/02-A...G0.exe
windows10-2004-x64
3inoz2/02-A...Jpg.js
windows7-x64
3inoz2/02-A...Jpg.js
windows10-2004-x64
3inoz2/02-A...ke.bat
windows7-x64
1inoz2/02-A...ke.bat
windows10-2004-x64
1inoz2/02-A...eg.bat
windows7-x64
1inoz2/02-A...eg.bat
windows10-2004-x64
1inoz2/02-A...jpg.js
windows7-x64
3inoz2/02-A...jpg.js
windows10-2004-x64
3inoz2/02-A...04.htm
windows7-x64
1inoz2/02-A...04.htm
windows10-2004-x64
1inoz2/02-A...nt.exe
windows7-x64
1inoz2/02-A...nt.exe
windows10-2004-x64
1Behavioral task
behavioral1
Sample
inoz2/01-INFO/01.htm
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
inoz2/01-INFO/01.htm
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
inoz2/01-INFO/02.htm
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
inoz2/01-INFO/02.htm
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
inoz2/02-ARTICLES/01.htm
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
inoz2/02-ARTICLES/01.htm
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
inoz2/02-ARTICLES/02.htm
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
inoz2/02-ARTICLES/02.htm
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
inoz2/02-ARTICLES/02_files/ASM/make32.bat
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
inoz2/02-ARTICLES/02_files/ASM/make32.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
inoz2/02-ARTICLES/02_files/ASM/ring0.exe
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
inoz2/02-ARTICLES/02_files/ASM/ring0.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
inoz2/02-ARTICLES/02_files/C/BACKUP.bat
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
inoz2/02-ARTICLES/02_files/C/BACKUP.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
inoz2/02-ARTICLES/02_files/C/MAKE.bat
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
inoz2/02-ARTICLES/02_files/C/MAKE.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
inoz2/02-ARTICLES/02_files/C/MAKEASM.bat
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
inoz2/02-ARTICLES/02_files/C/MAKEASM.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
inoz2/02-ARTICLES/02_files/C/_RING0.exe
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
inoz2/02-ARTICLES/02_files/C/_RING0.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
inoz2/02-ARTICLES/03_files/Delphi/ExtJpg.js
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
inoz2/02-ARTICLES/03_files/Delphi/ExtJpg.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
inoz2/02-ARTICLES/03_files/Delphi/Make.bat
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
inoz2/02-ARTICLES/03_files/Delphi/Make.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
inoz2/02-ARTICLES/03_files/Delphi/jpeg.bat
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
inoz2/02-ARTICLES/03_files/Delphi/jpeg.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
inoz2/02-ARTICLES/03_files/Delphi/jpg.js
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
inoz2/02-ARTICLES/03_files/Delphi/jpg.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
inoz2/02-ARTICLES/04.htm
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
inoz2/02-ARTICLES/04.htm
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
inoz2/02-ARTICLES/04_files/client.exe
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
inoz2/02-ARTICLES/04_files/client.exe
Resource
win10v2004-20240709-en
Target
601f469c262920eafd51acc721c025e5_JaffaCakes118
Size
1.2MB
MD5
601f469c262920eafd51acc721c025e5
SHA1
00b9ed8b2e9a24eff26ed588cc9213e3a76b2769
SHA256
521386b3db2486a230be028b4a64c4498080a1aa61a10c8e50c1ce7aef39864e
SHA512
d8dbdc9d37a2438e24e3927b50e3811265fed21ca50a7967ccbb0f5ef1f03e74800feb039c4cb06e08ef1b263d0fff2dc7242ff399974afd868e6c03c7274123
SSDEEP
24576:FSKlMknuMVbO263JhI/Ezd7vmT9xMVThOrpUZNTDtMxtrNIux8NMhzTKDCvG8RHp:AKqkna26vsEz+x+ZNlMxtrw7DCvhp
resource | yara_rule |
---|---|
static1/unpack001/inoz2/04-TOOLS/01_files/gluerS.exe | upx |
static1/unpack001/inoz2/04-TOOLS/02_files/MailRipper.exe | upx |
static1/unpack001/inoz2/05-VIRUSES/01_files/FarTF.exe | upx |
static1/unpack001/inoz2/inoz2.exe | upx |
Checks for missing Authenticode signature.
resource |
---|
unpack001/inoz2/02-ARTICLES/02_files/ASM/ring0.exe |
unpack001/inoz2/02-ARTICLES/02_files/C/_RING0.EXE |
unpack001/inoz2/02-ARTICLES/04_files/client.exe |
unpack001/inoz2/02-ARTICLES/04_files/server.exe |
unpack001/inoz2/02-ARTICLES/07_files/test.exe |
unpack001/inoz2/04-TOOLS/01_files/gluerS.exe |
unpack001/inoz2/04-TOOLS/02_files/MailRipper.exe |
unpack003/out.upx |
unpack001/inoz2/05-VIRUSES/01_files/FarTF.exe |
unpack004/out.upx |
unpack001/inoz2/inoz2.exe |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
MapViewOfFile
ExitProcess
LocalFree
NtClose
memset
RtlInitUnicodeString
NtOpenSection
SetSecurityInfo
SetEntriesInAclA
GetSecurityInfo
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
ord83
ord171
ord514
ord666
GetSecurityInfo
SetEntriesInAclA
SetSecurityInfo
CloseHandle
CreateFileA
ExitProcess
GetACP
GetCPInfo
GetCommandLineA
GetCurrentThreadId
GetEnvironmentStrings
GetFileType
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeW
GetVersion
GetVersionExA
GlobalMemoryStatus
HeapAlloc
HeapFree
LoadLibraryA
LocalFree
MapViewOfFile
MultiByteToWideChar
RaiseException
SetConsoleCtrlHandler
SetFilePointer
SetHandleCount
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualLock
WideCharToMultiByte
WriteFile
EnumThreadWindows
MessageBoxA
wsprintfA
__GetExceptDLLinfo
___CPPdebugHook
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
recv
connect
socket
send
listen
WSACleanup
WSAGetLastError
WSAStartup
accept
bind
closesocket
lstrlen
GetProcAddress
LocalAlloc
LoadLibraryA
ExitProcess
CreateThread
MessageBoxA
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
recv
connect
socket
send
listen
WSACleanup
WSAGetLastError
WSAStartup
accept
bind
closesocket
lstrlen
GetProcAddress
LocalAlloc
LoadLibraryA
ExitProcess
CreateThread
MessageBoxA
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
ExitProcess
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE