Static task
static1
Behavioral task
behavioral1
Sample
BVMModz v1.5.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
BVMModz v1.5.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
BVMModz.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
BVMModz.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
WolfGhost.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
WolfGhost.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Xtrap.dll
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
Xtrap.dll
Resource
win10v2004-20240802-en
General
-
Target
ddb67b26ee29aca17b1b4e4c9637cd45_JaffaCakes118
-
Size
3.1MB
-
MD5
ddb67b26ee29aca17b1b4e4c9637cd45
-
SHA1
235c3f54d9abb4475f41e8b841d5bed1178d0b8f
-
SHA256
1506e22832ce4c76a42166edb9d488263f591dfb4bf55f7e6bb91dfb8c1ae0b3
-
SHA512
0c98c745a622e04cfc12bd41c648a3c1fffac742f6dc143884a7873898937a54372a23313cddf1e2396db9f1481f1bcb5f3eaf8e6ed93269be6fd08be85c92c3
-
SSDEEP
98304:FPdJuQ8YvdXGVEVUupRguKEtUiFqsaOFZmo:XvdXGOpSuKgALEmo
Malware Config
Signatures
-
Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/BVMModz v1.5.exe unpack001/BVMModz.dll unpack001/WolfGhost.dll unpack001/Xtrap.dll
Files
-
ddb67b26ee29aca17b1b4e4c9637cd45_JaffaCakes118.rar
-
BVMModz v1.5.exe.exe windows:4 windows x86 arch:x86
69ed65fa65f38f208b246a848752896d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarSub
__vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaLenBstr
__vbaStrVarMove
ord697
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaNextEachVar
__vbaFreeObjList
ord516
ord517
_adj_fprem1
__vbaRecAnsiToUni
ord626
ord519
__vbaStrCat
ord660
__vbaLsetFixstr
__vbaRecDestruct
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
__vbaFileCloseAll
ord301
__vbaOnError
ord595
__vbaObjSet
_adj_fdiv_m16i
ord303
_adj_fdivr_m16i
ord520
__vbaStrFixstr
ord307
ord309
__vbaBoolVarNull
_CIsin
ord525
ord632
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
ord528
__vbaStrCmp
__vbaVarTstEq
__vbaPutOwner4
__vbaObjVar
__vbaI2I4
DllFunctionCall
_adj_fpatan
__vbaLateIdCallLd
__vbaRecUniToAnsi
EVENT_SINK_Release
ord600
__vbaUI1I2
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaVarMul
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord607
__vbaVarDiv
ord608
ord716
__vbaFPException
ord717
__vbaInStrVar
__vbaStrVarVal
__vbaVarCat
__vbaI2Var
ord644
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaInStr
__vbaVar2Vec
__vbaNew2
__vbaR8Str
__vbaVarInt
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
__vbaVarCmpLt
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
__vbaVarSetVar
__vbaI4Var
__vbaVarCmpEq
__vbaLateMemCall
__vbaVarAdd
__vbaStrComp
__vbaStrToAnsi
__vbaVarDup
__vbaVarMod
__vbaVarCopy
ord616
__vbaVarLateMemCallLd
__vbaRecDestructAnsi
ord617
_CIatan
__vbaCastObj
ord618
__vbaStrMove
__vbaForEachVar
ord619
_allmul
_CItan
__vbaAryUnlock
__vbaVarForNext
_CIexp
__vbaFreeObj
__vbaFreeStr
Sections
.text Size: 324KB - Virtual size: 323KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
BVMModz.dll.dll windows:4 windows x86 arch:x86
48e10045d850dc1cc1bc01bc3335396c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
storm
ord502
ord403
ord252
ord401
ord405
ord276
ord266
ord503
ord423
fog
ord10140
ord10079
ord10024
ord10066
ord10070
ord10021
ord10022
ord10033
ord10034
ord10141
ord10016
ord10026
ord10078
ord10076
ord10077
ord10075
gdwBitMasks
ord10072
ord10069
ord10023
ord10020
ord10067
kernel32
ExitProcess
TlsAlloc
TlsFree
TlsSetValue
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
SetFilePointer
CloseHandle
ReadFile
GetFileSize
OutputDebugStringA
CreateFileA
lstrlenA
GetTickCount
IsBadCodePtr
VirtualAlloc
VirtualFree
GetLastError
Sleep
GetModuleFileNameA
lstrcpyA
lstrcatA
GetDriveTypeA
GetLogicalDriveStringsA
SetEnvironmentVariableA
CompareStringW
FreeEnvironmentStringsW
WideCharToMultiByte
FlushFileBuffers
GetVersionExA
GetTimeZoneInformation
EnumSystemLocalesA
RtlUnwind
GetUserDefaultLCID
TerminateProcess
GetCurrentProcess
GetCommandLineA
GetVersion
HeapReAlloc
HeapAlloc
HeapSize
FatalAppExitA
HeapFree
GetCurrentThreadId
GetLocaleInfoW
CompareStringA
IsBadWritePtr
SetLastError
TlsGetValue
GetCurrentThread
GetProcAddress
GetModuleHandleA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetLocaleInfoA
GetCPInfo
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
WriteFile
LoadLibraryA
SetUnhandledExceptionFilter
IsBadReadPtr
UnhandledExceptionFilter
InterlockedDecrement
InterlockedIncrement
GetStringTypeA
GetACP
GetOEMCP
LCMapStringA
SetConsoleCtrlHandler
MultiByteToWideChar
GetStringTypeW
IsValidLocale
LCMapStringW
SetStdHandle
IsValidCodePage
user32
wsprintfA
Sections
.text Size: 160KB - Virtual size: 156KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
WolfGhost.dll.dll windows:4 windows x86 arch:x86
ce8ab431fbb2ecbc85250f5da649c004
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetLocaleInfoW
MulDiv
CreateThread
Sleep
GetModuleHandleA
GetModuleFileNameA
SetEndOfFile
SetStdHandle
GetStringTypeW
LoadLibraryA
GetProcAddress
OutputDebugStringA
WriteFile
GetLastError
CreateFileA
WideCharToMultiByte
GetVersionExA
CloseHandle
GetSystemInfo
IsProcessorFeaturePresent
EnterCriticalSection
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
HeapAlloc
GetProcessHeap
HeapFree
VirtualFree
VirtualAlloc
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
SetLastError
FlushInstructionCache
GetCurrentProcess
RtlUnwind
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
RaiseException
HeapDestroy
HeapCreate
HeapReAlloc
IsBadWritePtr
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
HeapSize
GetCPInfo
GetACP
GetOEMCP
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
LCMapStringA
LCMapStringW
ReadFile
SetFilePointer
GetCurrentProcessId
FlushFileBuffers
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetStringTypeA
VirtualProtect
user32
GetAsyncKeyState
MessageBoxA
RegisterClassExA
GetDesktopWindow
CreateWindowExA
DestroyWindow
DefWindowProcA
GetSystemMetrics
gdi32
SelectObject
SetTextColor
SetMapMode
CreateCompatibleDC
CreateDIBSection
DeleteObject
SetBkColor
SetTextAlign
DeleteDC
GetTextExtentPoint32A
ExtTextOutA
CreateFontA
GetDeviceCaps
d3d9
Direct3DCreate9
advapi32
RegQueryValueExA
RegOpenKeyA
RegCloseKey
Sections
.text Size: 328KB - Virtual size: 324KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 48KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sxdata Size: 4KB - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Xtrap.dll.dll windows:4 windows x86 arch:x86
48e10045d850dc1cc1bc01bc3335396c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
storm
ord502
ord403
ord252
ord401
ord405
ord276
ord266
ord503
ord423
fog
ord10140
ord10079
ord10024
ord10066
ord10070
ord10021
ord10022
ord10033
ord10034
ord10141
ord10016
ord10026
ord10078
ord10076
ord10077
ord10075
gdwBitMasks
ord10072
ord10069
ord10023
ord10020
ord10067
kernel32
ExitProcess
TlsAlloc
TlsFree
TlsSetValue
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
SetFilePointer
CloseHandle
ReadFile
GetFileSize
OutputDebugStringA
CreateFileA
lstrlenA
GetTickCount
IsBadCodePtr
VirtualAlloc
VirtualFree
GetLastError
Sleep
GetModuleFileNameA
lstrcpyA
lstrcatA
GetDriveTypeA
GetLogicalDriveStringsA
SetEnvironmentVariableA
CompareStringW
FreeEnvironmentStringsW
WideCharToMultiByte
FlushFileBuffers
GetVersionExA
GetTimeZoneInformation
EnumSystemLocalesA
RtlUnwind
GetUserDefaultLCID
TerminateProcess
GetCurrentProcess
GetCommandLineA
GetVersion
HeapReAlloc
HeapAlloc
HeapSize
FatalAppExitA
HeapFree
GetCurrentThreadId
GetLocaleInfoW
CompareStringA
IsBadWritePtr
SetLastError
TlsGetValue
GetCurrentThread
GetProcAddress
GetModuleHandleA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetLocaleInfoA
GetCPInfo
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
WriteFile
LoadLibraryA
SetUnhandledExceptionFilter
IsBadReadPtr
UnhandledExceptionFilter
InterlockedDecrement
InterlockedIncrement
GetStringTypeA
GetACP
GetOEMCP
LCMapStringA
SetConsoleCtrlHandler
MultiByteToWideChar
GetStringTypeW
IsValidLocale
LCMapStringW
SetStdHandle
IsValidCodePage
user32
wsprintfA
Sections
.text Size: 160KB - Virtual size: 156KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
vknt.fon