d1e811880bc5affb136360a06b84bf9e_JaffaCakes118
- SHA256 ce425beafc31b0718d3539655a74b9d54e0af34a98881fa370d64a773dd0388a
Behavioral task
behavioral1
Sample
Monster Hunter World v20200109-v20200205 Plus 66 Trainer.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Monster Hunter World v20200109-v20200205 Plus 66 Trainer.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
v2/Monster Hunter World v20200109-v20200205 Plus 66 Trainer v2.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
v2/Monster Hunter World v20200109-v20200205 Plus 66 Trainer v2.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target d1e811880bc5affb136360a06b84bf9e_JaffaCakes118
- Size 1.5MB
- Sample240907-pdasjstdrl
- SHA256 ce425beafc31b0718d3539655a74b9d54e0af34a98881fa370d64a773dd0388a
- MD5 d1e811880bc5affb136360a06b84bf9e
- SHA1 ec8d774346d2f6cb3cf0b7c23eb5b0d1e9a64950
- SHA512 a84e69e3e1ce207d70de81d2c39b3e129e1fd742459a4ba5b35f543afdd605a5d63d5e6e5a1fe213acc93a458c97dedb127038f61681d00acf658a870b021e85
- SSDEEP 49152:nbupPBoJqT1ANGWw6+V6QzylI1F3sg+3Uk:n8PBJ5Erw68Eo8dUk
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- R77 family
- r77 rootkit payload 2 IoCs
Detects the payload of the r77 rootkit.
resource yara_rule static1/unpack001/Monster Hunter World v20200109-v20200205 Plus 66 Trainer.exe r77_payload static1/unpack001/v2/Monster Hunter World v20200109-v20200205 Plus 66 Trainer v2.exe r77_payload - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Monster Hunter World v20200109-v20200205 Plus 66 Trainer.exe unpack001/v2/Monster Hunter World v20200109-v20200205 Plus 66 Trainer v2.exe
File Explorer
-
d1e811880bc5affb136360a06b84bf9e_JaffaCakes118.rar 1.5MB
-
Monster Hunter World v20200109-v20200205 Plus 66 Trainer.exe.exe 1.8MB
-
v2/Monster Hunter World v20200109-v20200205 Plus 66 Trainer v2.exe.exe 1.8MB
Monster Hunter World v20200109-v20200205 Plus 66 Trainer.exe
- IMPHASH 4048d738ded1c82c336c66ca8ccbb888
- SHA256 3b338fd7103945457f54d57fb680d9f90f6d4b35a2890a1e067394a594bc209c
- MD5 d8c374e06eb50b0db53e0c7ce48bbee1
- SHA1 9153f2d7e1568a727efbf44e2eea4357dcff6913
- SHA512 120200695e634ca0b83fd5d29eb1257a47f1e593973b17cdd1fc0d9ff7686965bf889a0032daabdb8fd33134e575f67c3f4c3a67d1a4477e85ff184ca7e51681
- SSDEEP 24576:1+l/qtAXxSE8zuWKXWZy5x4eyD2xZgjqOOGaPECkDtGQjnEd6vVfaceDSfWB:y3SRwXgXw4OZ/kwonPvtac
- MD5 SHA1 SHA512 SSDEEP
-
r77 rootkit payload
Detects the payload of the r77 rootkit.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
210036
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
UnmapViewOfFile
Sleep
CloseHandle
LoadLibraryW
GetProcAddress
GetCurrentProcessId
CreateFileMappingW
MapViewOfFile
ReadFile
WritePrivateProfileStringW
WriteFile
CreateFileW
GetModuleHandleA
GetPrivateProfileStringW
GetLastError
LoadLibraryA
WaitNamedPipeW
SizeofResource
LockResource
LoadResource
FindResourceW
GetModuleHandleW
GetModuleFileNameW
GetFileAttributesW
MultiByteToWideChar
FreeLibrary
LoadLibraryExW
GetCurrentProcess
IsWow64Process
SetLastError
WaitForSingleObject
ResumeThread
CreateDirectoryW
GetTempPathW
RaiseException
WriteConsoleW
HeapSize
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
HeapReAlloc
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
WideCharToMultiByte
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
EncodePointer
DecodePointer
QueryPerformanceCounter
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
LocalFree
CreateTimerQueue
SetEvent
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwindEx
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitThread
GetStdHandle
SetFilePointerEx
HeapAlloc
HeapFree
FlushFileBuffers
GetConsoleCP
GetConsoleMode
IsValidLocale
user32
MessageBoxA
MessageBoxW
shell32
SHGetFolderPathW
oleaut32
SafeArrayAccessData
SafeArrayCreateVector
SafeArrayCreate
SafeArrayUnaccessData
SafeArrayDestroy
mscoree
CLRCreateInstance
CorBindToRuntime
wininet
InternetOpenA
InternetReadFile
InternetOpenUrlA
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
winmm
PlaySoundW
Name
.text
Size
484KB
Virtual Size
483KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
185KB
Virtual Size
185KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=26715,
count=20, id=260, version=26715,
count=179, id=261, version=26715,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=17, id=260, version=28117,
count=9, id=259, version=28117,
count=147, id=261, version=28117,
count=15, id=257, version=26715,
count=180, id=1, productName=Unmarked objects,
count=16, id=265, version=28314,
count=1, id=255, productName=VS2019 v16.4.0 build 28314, version=28314,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.4.0 build 28314, version=28314,
v2/Monster Hunter World v20200109-v20200205 Plus 66 Trainer v2.exe
- IMPHASH 4048d738ded1c82c336c66ca8ccbb888
- SHA256 3f58c0fb65c6353a7beddaf59aa5e86431b959f6eea8a05d2d20ee5c962978d2
- MD5 11db93fd5bb6f048922e584f6181dd45
- SHA1 547fe0e358eb48b7c933e940c5efd8de0ad82286
- SHA512 fda67f65fd0998acad6ac5b55d5de8930ca42a8098f4ccb50860a660ce29734d986b70f97d01df85ac731fb38b0f35a5244813ba1906a5c5929dc5eee3d24cab
- SSDEEP 24576:s1w4MNJ1kgD8TizIiT+x/fEITuQ05VwW3aPECkDtGQjnEd6vVfaceDSfWB:8e19ZzviYvhQ/kwonPvtac
- MD5 SHA1 SHA512 SSDEEP
-
r77 rootkit payload
Detects the payload of the r77 rootkit.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
209444
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
UnmapViewOfFile
Sleep
CloseHandle
LoadLibraryW
GetProcAddress
GetCurrentProcessId
CreateFileMappingW
MapViewOfFile
ReadFile
WritePrivateProfileStringW
WriteFile
CreateFileW
GetModuleHandleA
GetPrivateProfileStringW
GetLastError
LoadLibraryA
WaitNamedPipeW
SizeofResource
LockResource
LoadResource
FindResourceW
GetModuleHandleW
GetModuleFileNameW
GetFileAttributesW
MultiByteToWideChar
FreeLibrary
LoadLibraryExW
GetCurrentProcess
IsWow64Process
SetLastError
WaitForSingleObject
ResumeThread
CreateDirectoryW
GetTempPathW
RaiseException
WriteConsoleW
HeapSize
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
HeapReAlloc
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
WideCharToMultiByte
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
EncodePointer
DecodePointer
QueryPerformanceCounter
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
LocalFree
CreateTimerQueue
SetEvent
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwindEx
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitThread
GetStdHandle
SetFilePointerEx
HeapAlloc
HeapFree
FlushFileBuffers
GetConsoleCP
GetConsoleMode
IsValidLocale
user32
MessageBoxA
MessageBoxW
shell32
SHGetFolderPathW
oleaut32
SafeArrayAccessData
SafeArrayCreateVector
SafeArrayCreate
SafeArrayUnaccessData
SafeArrayDestroy
mscoree
CLRCreateInstance
CorBindToRuntime
wininet
InternetOpenA
InternetReadFile
InternetOpenUrlA
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
winmm
PlaySoundW
Name
.text
Size
483KB
Virtual Size
482KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
185KB
Virtual Size
185KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=26715,
count=20, id=260, version=26715,
count=179, id=261, version=26715,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=17, id=260, version=28117,
count=9, id=259, version=28117,
count=147, id=261, version=28117,
count=15, id=257, version=26715,
count=180, id=1, productName=Unmarked objects,
count=16, id=265, version=28314,
count=1, id=255, productName=VS2019 v16.4.0 build 28314, version=28314,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.4.0 build 28314, version=28314,