Static task
static1
Behavioral task
behavioral1
Sample
Rang_Hack/RangHack_By_Rakim.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Rang_Hack/RangHack_By_Rakim.dll
Resource
win10v2004-20241007-en
General
-
Target
3aa42894a0151a9c3a043c5dfb21eaef_JaffaCakes118
-
Size
14KB
-
MD5
3aa42894a0151a9c3a043c5dfb21eaef
-
SHA1
08d8204d76d1166154fba73b0789a09062c2e7ed
-
SHA256
1b1aecbd48761033b090c543f6b1a3e8d8cd1c180d22c3ef0743296fc651cb6c
-
SHA512
b6c5ec46a7c815bb8ce808cc43066275d8a117b46c6beeca17a46ea43398eede3e0ecb65be266b2c6b99a3899de4b8e7ddd865d0b65f1077e920d6ebae75a294
-
SSDEEP
384:jDIaJD7zs99+yIML0maN5GVXQxAxbbA2x/C:dJXBrMQVN5GlqAdbj/C
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Rang_Hack/RangHack_By_Rakim.dll
Files
-
3aa42894a0151a9c3a043c5dfb21eaef_JaffaCakes118.rar
-
Rang_Hack/RangHack_By_Rakim.dll.dll windows:5 windows x86 arch:x86
88000f7cdcad6267bbcd54d515e01c5d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualProtect
Sleep
GetCurrentProcess
ReadProcessMemory
GetModuleHandleA
LoadLibraryA
ExitThread
CreateThread
GetDriveTypeA
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
user32
SetRect
GetAsyncKeyState
MessageBeep
d3dx9_41
D3DXCreateSprite
D3DXCreateFontA
D3DXCreateTextureFromFileInMemoryEx
msvcr100
free
_encoded_null
_malloc_crt
_initterm_e
_amsg_exit
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
clock
sprintf
memset
malloc
memcpy
_initterm
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ