Behavioral task
behavioral1
Sample
mxdsg/MMxdSg.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
mxdsg/MMxdSg.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
mxdsg/MxdSg.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
mxdsg/MxdSg.exe
Resource
win10v2004-20241007-en
General
-
Target
2aa2a9129cfc09fdee9eb81de11e5087_JaffaCakes118
-
Size
2.5MB
-
MD5
2aa2a9129cfc09fdee9eb81de11e5087
-
SHA1
4b89af0cc64e121437af8f7155d9be7e9df596af
-
SHA256
4046f39420808808a4f5fe2486e8dfc28af7f334f184df332d5d73ddd5aeaa88
-
SHA512
0f4046020757e9d0f8048801eb1f348e9954b6ee775225aad743f0f4ffd872b85beb06f6fe2a3022ca45b3c83c2ef46616a1ce4e75332b12589c5f3c6a74ae07
-
SSDEEP
49152:mVLTE6QI5Z98JtaXXywb9CGPYjv0VIQU7DEk3CkuBR69Us2DEMqXCaZE:mVLxXbGJtOC8CGPyv0GQU7pCkuS9V2Df
Malware Config
Signatures
-
resource yara_rule static1/unpack001/mxdsg/MMxdSg.dll aspack_v212_v242 -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/mxdsg/MMxdSg.dll unpack001/mxdsg/MxdSg.exe
Files
-
2aa2a9129cfc09fdee9eb81de11e5087_JaffaCakes118.rar
-
mxdsg/MMxdSg.dll.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 167KB - Virtual size: 396KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 17KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xpr Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
mxdsg/MxdSg.exe.exe windows:4 windows x86 arch:x86
fdbfec85672f73d2a4d49635454936d4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetProcAddress
GetModuleHandleA
LoadLibraryA
ExitProcess
user32
MessageBoxA
Sections
CODE Size: 441KB - Virtual size: 896KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 9KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.10 Size: 58KB - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 30KB - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.11 Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.perplex Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
mxdsg/Script/上海北部平原 .txt
-
mxdsg/Script/上海北部平原.txt
-
mxdsg/Script/丢失时间2.txt
-
mxdsg/Script/主巢穴山峰.txt
-
mxdsg/Script/主穴山峰3.txt
-
mxdsg/Script/主龙穴.txt
-
mxdsg/Script/冰人马领地.txt
-
mxdsg/Script/冰冷死亡战场.txt
-
mxdsg/Script/冰火战场.txt
-
mxdsg/Script/冰面2.txt
-
mxdsg/Script/冰面I.txt
-
mxdsg/Script/危险的峡谷2 .txt
-
mxdsg/Script/地铁4.txt
-
mxdsg/Script/地铁一号线第一地区.txt
-
mxdsg/Script/天空之巢1 .txt
-
mxdsg/Script/天空之巢2.txt
-
mxdsg/Script/天空之巢路口 .txt
-
mxdsg/Script/天空露台1.txt
-
mxdsg/Script/天空露台2 .txt
-
mxdsg/Script/天空露台3.txt
-
mxdsg/Script/天空露台4.txt
-
mxdsg/Script/天空露台5.txt
-
mxdsg/Script/寒冰半马人领土.txt
-
mxdsg/Script/寒冰平原 .txt
-
mxdsg/Script/射手1下面3层.txt
-
mxdsg/Script/尖峭的山丘.txt
-
mxdsg/Script/尖锐的绝壁2 .txt
-
mxdsg/Script/山羊峡谷 .txt
-
mxdsg/Script/巨人林 土豆.txt
-
mxdsg/Script/怪脾气森林.txt
-
mxdsg/Script/时间之路1.txt
-
mxdsg/Script/时间之路3.txt
-
mxdsg/Script/时间之路4.txt
-
mxdsg/Script/时间消失之路2 .txt
-
mxdsg/Script/时间隧道.txt
-
mxdsg/Script/暗黑半人马领土.txt
-
mxdsg/Script/森林岔道.txt
-
mxdsg/Script/死亡3.txt
-
mxdsg/Script/死亡4.txt
-
mxdsg/Script/死亡森林2 .txt
-
mxdsg/Script/死亡森林3 .txt
-
mxdsg/Script/死亡森林4 .txt
-
mxdsg/Script/消失森林.txt
-
mxdsg/Script/消失的树林 .txt
-
mxdsg/Script/火焰之地2.txt
-
mxdsg/Script/火焰之地I.txt
-
mxdsg/Script/火焰半人马领地 .txt
-
mxdsg/Script/火焰树林.txt
-
mxdsg/Script/火焰死亡战场.txt
-
mxdsg/Script/火焰黑暗战场.txt
-
mxdsg/Script/狼人领土1 .txt
-
mxdsg/Script/狼人领土2 .txt
-
mxdsg/Script/狼人领土3 .txt
-
mxdsg/Script/猪的海岸 .txt
-
mxdsg/Script/王冠之地 .txt
-
mxdsg/Script/玩具塔4.txt
-
mxdsg/Script/白云露台1.txt
-
mxdsg/Script/白云露台2.txt
-
mxdsg/Script/白云露台3.txt
-
mxdsg/Script/白云露台5.txt
-
mxdsg/Script/石人寺院入口.txt
-
mxdsg/Script/神木村东边森林 .txt
-
mxdsg/Script/神木村西边森林 .txt
-
mxdsg/Script/神木村西边森林.txt
-
mxdsg/Script/米纳尔森林东边境界 .txt
-
mxdsg/Script/結凍得平原.txt
-
mxdsg/Script/结冰平原1 .txt
-
mxdsg/Script/结冰平原2.txt
-
mxdsg/Script/结冰的平原II.txt
-
mxdsg/Script/遗忘的龙之巢穴.txt
-
mxdsg/Script/野猪领土1 .txt
-
mxdsg/Script/隐藏龙庙1.txt
-
mxdsg/Script/露台大厅.txt
-
mxdsg/Script/黑暗人马领地.txt
-
mxdsg/Script/龙林1 .txt
-
mxdsg/Script/龙林2.txt
-
mxdsg/Script/龙林入口.txt
-
mxdsg/SysIo.VXD
-
mxdsg/SysIo.sys