D:\project\MWare\Product\TokyoNecro\bin\凍京NECRO.pdb
Behavioral task
behavioral1
Sample
de4e2415929f7b72180e3220f299a412_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
de4e2415929f7b72180e3220f299a412_JaffaCakes118
-
Size
2.1MB
-
MD5
de4e2415929f7b72180e3220f299a412
-
SHA1
b1f0fbb936cc1afc4261a3d0594a029beb3ce6c3
-
SHA256
e7deabbdea4382d968f6258e8d33f8da3f926b0091853a78f0044a2bb342f6f2
-
SHA512
987c345d00db0c69d764c5495186c9eaaef557f0076aad3f375355a93cb454df8e8d56fa152f6f5b84691c464d3292eaa4d872809ae900b67fe1f5d20124b87e
-
SSDEEP
49152:4JsFUnSPFe1ZZz8pKZxqHNABnjgk2yiLJ1OzY9/4NGN/2k8MkTvI82:4JsJPFendCKZcNABn0k2yiLJ1O0KNW2u
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource de4e2415929f7b72180e3220f299a412_JaffaCakes118
Files
-
de4e2415929f7b72180e3220f299a412_JaffaCakes118.exe windows:5 windows x86 arch:x86
51e3e9afdf4a5142e721f5695001aa79
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ole32
StringFromCLSID
CoTaskMemFree
CoInitialize
CoCreateInstance
CoUninitialize
CreateStreamOnHGlobal
gdi32
GetDeviceCaps
user32
SetWindowLongA
IsDlgButtonChecked
InvalidateRect
UpdateWindow
GetDC
ReleaseDC
SetWindowPos
GetDesktopWindow
EnableWindow
CallWindowProcA
RegisterWindowMessageA
GetWindowRect
EndPaint
wsprintfA
SetWindowTextA
ShowCursor
GetActiveWindow
PostMessageA
LoadImageA
SendMessageA
SetTimer
MessageBoxA
DefWindowProcA
PostQuitMessage
GetWindowLongA
SetCursor
DialogBoxParamA
EndDialog
KillTimer
GetDlgItem
SetDlgItemTextA
BeginPaint
LoadCursorA
MessageBoxW
CharUpperBuffW
shell32
ShellExecuteA
SHGetFolderPathA
gdiplus
GdipFree
GdipAlloc
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImageRectI
GdiplusStartup
GdiplusShutdown
GdipDisposeImage
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromStream
libcurl
curl_multi_info_read
curl_multi_remove_handle
curl_easy_reset
curl_easy_setopt
curl_multi_add_handle
curl_multi_perform
curl_easy_init
curl_easy_cleanup
curl_multi_init
curl_multi_setopt
curl_multi_cleanup
kernel32
ExitThread
GetTimeZoneInformation
GetFileAttributesA
GetExitCodeProcess
MoveFileA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
SetEvent
SetFilePointerEx
InitializeCriticalSection
CreateEventA
GetProcessHeap
CreateNamedPipeA
CreateThread
WaitForSingleObject
TerminateThread
ReadFile
ConnectNamedPipe
DisconnectNamedPipe
lstrcpynA
CreateFileA
DeleteFileA
CreateProcessA
CreateMutexA
GetLastError
ReleaseMutex
CloseHandle
FindFirstFileA
FindNextFileA
FindClose
MoveFileExA
GetTempPathA
GetCurrentDirectoryA
FindResourceA
SizeofResource
LoadResource
LockResource
GlobalAlloc
GlobalLock
GlobalFree
GlobalUnlock
FreeLibrary
DecodePointer
EncodePointer
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
GetModuleFileNameW
HeapFree
HeapAlloc
IsProcessorFeaturePresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThreadId
GetProcAddress
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
Sleep
HeapSize
ExitProcess
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
EnterCriticalSection
LeaveCriticalSection
LoadLibraryW
RtlUnwind
GetStringTypeW
HeapReAlloc
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleW
FlushFileBuffers
CreateFileW
lstrcatA
lstrcpyA
lstrlenW
lstrlenA
LoadLibraryA
GetProcAddress
GetLastError
FreeLibrary
InitializeCriticalSection
GetModuleFileNameW
GetModuleHandleW
TerminateProcess
GetCurrentProcess
DeleteCriticalSection
LoadLibraryW
CreateEventW
CompareStringW
SetLastError
GetModuleHandleA
VirtualProtect
GetTickCount
EnterCriticalSection
LeaveCriticalSection
VirtualFree
VirtualAlloc
WriteProcessMemory
CreateToolhelp32Snapshot
GetCurrentProcessId
GetCurrentThreadId
Thread32First
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
GetSystemInfo
LoadResource
MultiByteToWideChar
WideCharToMultiByte
FindResourceExW
FindResourceExA
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
HeapAlloc
HeapFree
HeapDestroy
HeapCreate
GetSystemTime
GetLocalTime
SystemTimeToFileTime
CompareFileTime
GetCommandLineA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
GetModuleFileNameA
RaiseException
Sleep
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
RtlUnwind
HeapSize
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
VirtualQuery
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
oleaut32
SysAllocStringLen
SysFreeString
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
winmm
timeGetTime
advapi32
RegCloseKey
RegOpenKeyExA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
GetUserNameA
RegQueryValueExA
mware
??4Vector3D@Mware@@QAEAAV01@ABV01@@Z
??0CBoxAABB@Mware@@QAE@XZ
??1CPlane@Mware@@QAE@XZ
?Line_Plane@Collision@Mware@@YAJABVCLine3D@2@ABVCPlane@2@AAVVector3D@2@@Z
?FromNormal@CPlane@Mware@@QAEXABVVector3D@2@0@Z
??0CPlane@Mware@@QAE@XZ
??1CBoxAABB@Mware@@QAE@XZ
?Line_BoxAABB@Collision@Mware@@YAJABVCLine3D@2@ABVCBoxAABB@2@@Z
?BoxAABB_BoxAABB@Collision@Mware@@YAJABVCBoxAABB@2@0@Z
??0CBoxAABB@Mware@@QAE@ABVVector3D@1@0@Z
??0CLine3D@Mware@@QAE@XZ
??4CSceneStateDesc@Mware@@QAEAAV01@ABV01@@Z
?LookAt@Matrix4x4@Mware@@QAEAAV12@ABVVector3D@2@00@Z
?Ortho@Matrix4x4@Mware@@QAEAAV12@MMMM@Z
?LengthSq@Vector2D@Mware@@QBEMXZ
??DMatrix4x4@Mware@@QBE?AV01@M@Z
??HMatrix4x4@Mware@@QBE?AV01@ABV01@@Z
??GVector4D@Mware@@QBE?AV01@XZ
?SetUp@Matrix4x4@Mware@@QAEXABVVector4D@2@@Z
?SetRight@Matrix4x4@Mware@@QAEXABVVector4D@2@@Z
?Cross@Vector4D@Mware@@QAEAAV12@ABV12@0@Z
?Dot@Vector4D@Mware@@QBEMABV12@@Z
?Normalize@Vector4D@Mware@@QAEAAV12@XZ
?Translation@Matrix4x4@Mware@@QAEAAV12@ABVVector3D@2@@Z
?SetMersenneTwister@CRandom@Mware@@QAEJPBEABK@Z
?SetMersenneTwisterCount@CRandom@Mware@@QAEXABJ@Z
?GetMersenneTwister@CRandom@Mware@@QBEJPAEABK@Z
?GetMersenneTwisterSize@CRandom@Mware@@QBE?BJXZ
?GetMersenneTwisterCount@CRandom@Mware@@QBEABJXZ
?RotationXYZ@Quaternion@Mware@@QAEAAV12@MMM@Z
?Conjugate@Quaternion@Mware@@QAEAAV12@XZ
?Length@Quaternion@Mware@@QBEMXZ
?LengthSq@Quaternion@Mware@@QBEMXZ
?Normalize@Quaternion@Mware@@QAEAAV12@XZ
?Dot@Quaternion@Mware@@QBEMABV12@@Z
?Mul@Quaternion@Mware@@QAEAAV12@ABV12@@Z
?Sub@Quaternion@Mware@@QAEAAV12@ABV12@@Z
?Add@Quaternion@Mware@@QAEAAV12@ABV12@@Z
?RotationAxis@Vector3D@Mware@@QAEAAV12@MABV12@@Z
?SetFront@Matrix4x4@Mware@@QAEXABVVector4D@2@@Z
?GetFront@Matrix4x4@Mware@@QBE?AVVector4D@2@XZ
?GetUp@Matrix4x4@Mware@@QBE?AVVector4D@2@XZ
?GetRight@Matrix4x4@Mware@@QBE?AVVector4D@2@XZ
?Dissolution@Matrix4x4@Mware@@QBEXPAVVector3D@2@0PAV12@@Z
?RotationAxis@Matrix4x4@Mware@@QAEAAV12@MABVVector3D@2@@Z
?GetTranslation@Matrix4x4@Mware@@SA?AV12@MMM@Z
?GetScaling@Matrix4x4@Mware@@SA?AV12@MMM@Z
?Set@Vector3D@Mware@@QAEAAV12@MMM@Z
?RotationY@Matrix4x4@Mware@@QAEAAV12@M@Z
?RotationX@Matrix4x4@Mware@@QAEAAV12@M@Z
?RotationZ@Matrix4x4@Mware@@QAEAAV12@M@Z
??HVector3D@Mware@@QBE?AV01@M@Z
??1CLine3D@Mware@@QAE@XZ
??0CLine3D@Mware@@QAE@ABVVector3D@1@0@Z
??0CLine3D@Mware@@QAE@MMMMMM@Z
?Transform@Vector4D@Mware@@QAEAAV12@ABVMatrix4x4@2@@Z
??0Vector4D@Mware@@QAE@ABVVector3D@1@@Z
?Reflect@Vector3D@Mware@@QAEAAV12@ABV12@@Z
??KVector4D@Mware@@QBE?AV01@M@Z
??GVector4D@Mware@@QBE?AV01@ABV01@@Z
??DVector4D@Mware@@QBE?AV01@M@Z
??HVector4D@Mware@@QBE?AV01@ABV01@@Z
??0Matrix4x4@Mware@@QAE@ABVQuaternion@1@@Z
?TransformCoord@Vector3D@Mware@@QAEAAV12@ABVMatrix4x4@2@@Z
??0Quaternion@Mware@@QAE@MMMM@Z
?Cross@Vector3D@Mware@@QAEAAV12@ABV12@0@Z
?GetPosition@Matrix4x4@Mware@@QBE?AVVector3D@2@XZ
?GetRotationZ@Matrix4x4@Mware@@SA?AV12@M@Z
?GetRotationY@Matrix4x4@Mware@@SA?AV12@M@Z
?GetRotationX@Matrix4x4@Mware@@SA?AV12@M@Z
?GetRotationZXY@Matrix4x4@Mware@@SA?AV12@MMM@Z
??0Matrix4x4@Mware@@QAE@ABV01@@Z
?GetRotationAxis@Matrix4x4@Mware@@SA?AV12@MABVVector3D@2@@Z
?Transform@Vector3D@Mware@@QAEAAV12@ABVMatrix4x4@2@@Z
??DVector2D@Mware@@QBE?AV01@ABV01@@Z
??DVector3D@Mware@@QBE?AV01@ABV01@@Z
??4Vector4D@Mware@@QAEAAV01@ABV01@@Z
??0CFile@Mware@@QAE@XZ
??1CFile@Mware@@QAE@XZ
?Open@CFile@Mware@@QAEJPBDW4eFileOpenMode@2@@Z
?Close@CFile@Mware@@QAEJXZ
?IsOpened@CFile@Mware@@QAEJXZ
?Write@CFile@Mware@@QAEJPBXK@Z
?Read@CFile@Mware@@QAEKPAXK@Z
?Load@CFile@Mware@@QAEKXZ
?GetFileSize@CFile@Mware@@QAEKXZ
?SeekStart@CFile@Mware@@QAEKJ@Z
?SeekEnd@CFile@Mware@@QAEKJ@Z
?Seek@CFile@Mware@@QAEKJ@Z
?GetFilePosition@CFile@Mware@@QAEKXZ
?GetLoadData@CFile@Mware@@QAEPAXXZ
?GetFileName@CFile@Mware@@QAEPBDXZ
?Flush@CFile@Mware@@QAEJXZ
??1Vector2D@Mware@@QAE@XZ
??0CCriticalSection@Mware@@QAE@XZ
??1CCriticalSection@Mware@@UAE@XZ
?CreateMware@Mware@@YAPAVICore@1@XZ
??0Vector2D@Mware@@QAE@MM@Z
?Enter@CCriticalSection@Mware@@QAEXXZ
?Leave@CCriticalSection@Mware@@QAEXXZ
??0CSceneStateDesc@Mware@@QAE@XZ
??1Vector4D@Mware@@QAE@XZ
??1CSceneStateDesc@Mware@@QAE@XZ
??0Vector2D@Mware@@QAE@XZ
??0Vector4D@Mware@@QAE@MMMM@Z
??0Vector3D@Mware@@QAE@XZ
??1Vector3D@Mware@@QAE@XZ
??0Vector3D@Mware@@QAE@MMM@Z
??0Vector3D@Mware@@QAE@ABVVector2D@1@@Z
??DVector2D@Mware@@QBE?AV01@M@Z
??0Vector3D@Mware@@QAE@ABV01@@Z
??0Matrix4x4@Mware@@QAE@XZ
??1Matrix4x4@Mware@@QAE@XZ
?Scaling@Matrix4x4@Mware@@QAEAAV12@MMM@Z
??0Quaternion@Mware@@QAE@ABV01@@Z
?RotationAxis@Quaternion@Mware@@QAEAAV12@ABVVector3D@2@M@Z
??0Quaternion@Mware@@QAE@XZ
??1Quaternion@Mware@@QAE@XZ
??XQuaternion@Mware@@QAEAAV01@ABV01@@Z
?RotationQuaternion@Matrix4x4@Mware@@QAEAAV12@ABVQuaternion@2@@Z
?RotationZXY@Matrix4x4@Mware@@QAEAAV12@MMM@Z
??YVector3D@Mware@@QAEAAV01@ABV01@@Z
?Translation@Matrix4x4@Mware@@QAEAAV12@MMM@Z
??DMatrix4x4@Mware@@QBE?AV01@ABV01@@Z
?IsIdentity@Matrix4x4@Mware@@QAEJXZ
??0Vector2D@Mware@@QAE@ABV01@@Z
??0Vector2D@Mware@@QAE@ABVVector3D@1@@Z
??0CLine2D@Mware@@QAE@XZ
??HVector2D@Mware@@QBE?AV01@ABV01@@Z
?Line_Line@Collision@Mware@@YAJABVCLine2D@2@0@Z
?Set@Vector2D@Mware@@QAEAAV12@MM@Z
??0Vector4D@Mware@@QAE@ABV01@@Z
??0Vector4D@Mware@@QAE@XZ
??0Vector3D@Mware@@QAE@ABVVector4D@1@@Z
??DVector3D@Mware@@QBE?AV01@M@Z
??0Vector2D@Mware@@QAE@ABVVector4D@1@@Z
??9Vector3D@Mware@@QBEJABV01@@Z
??GVector3D@Mware@@QBE?AV01@ABV01@@Z
??4Vector3D@Mware@@QAEAAV01@M@Z
??HVector3D@Mware@@QBE?AV01@ABV01@@Z
??XVector3D@Mware@@QAEAAV01@M@Z
??KVector3D@Mware@@QBE?AV01@M@Z
??GVector2D@Mware@@QBE?AV01@ABV01@@Z
??KVector2D@Mware@@QBE?AV01@M@Z
?Length@Vector3D@Mware@@QBEMXZ
?LengthSq@Vector3D@Mware@@QBEMXZ
?Normalize@Vector3D@Mware@@QAEAAV12@XZ
?Hermite@Vector3D@Mware@@QAEAAV12@ABV12@000M@Z
?Lerp@Vector3D@Mware@@QAEAAV12@ABV12@0M@Z
??1CLine2D@Mware@@QAE@XZ
??0CRandom@Mware@@QAE@XZ
??1CRandom@Mware@@UAE@XZ
??_7CRandom@Mware@@6B@
?Seed@CRandom@Mware@@QAEXJ@Z
?Identity@Matrix4x4@Mware@@QAEXXZ
?GetFloat@CRandom@Mware@@QAEMMM@Z
?GetInt@CRandom@Mware@@QAEJJJ@Z
?SetPosition@Matrix4x4@Mware@@QAEXABVVector3D@2@@Z
?GetScale@Matrix4x4@Mware@@QBE?AV12@XZ
??XMatrix4x4@Mware@@QAEAAV01@ABV01@@Z
?Inverse@Matrix4x4@Mware@@QAEAAV12@XZ
??0CRandom@Mware@@QAE@J@Z
??GVector3D@Mware@@QBE?AV01@XZ
?Cross@Vector2D@Mware@@QBEMABV12@@Z
?GetNormalize@Vector3D@Mware@@SA?AV12@ABV12@@Z
?Dot@Vector3D@Mware@@QBEMABV12@@Z
?Cross@Vector3D@Mware@@QAEAAV12@ABV12@@Z
??XVector3D@Mware@@QAEAAV01@ABV01@@Z
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 238KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 704KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 606KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ