Behavioral task
behavioral1
Sample
Trojan.Win32.Monderb.dll
Resource
win7-20240903-en
General
-
Target
40a7ba258400b0fff32455324624358f_JaffaCakes118
-
Size
29KB
-
MD5
40a7ba258400b0fff32455324624358f
-
SHA1
ffc6b37288a3de3f26c91ca8fdfe38a458686fa7
-
SHA256
e16b9b8d219f4377eb98c52fc59aa0a8cdd1c1a1e3245e759854e5fa84809df1
-
SHA512
d7af5950e8733caf0da2b778ae50013793a0cb8a1a26d2698607fcd5ce047a028cb6d8ef85c97f4e3a314531e61cee569b8b2e753e33decce5a335e36fd93109
-
SSDEEP
768:U44scnRK3laA0VfxmBPkxdEKEBL/88cIMwBCQ786U:14Hk8WkzZiZcIMwBn86U
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule static1/unpack001/Trojan.Win32.Monderb.adto acprotect -
resource yara_rule static1/unpack001/Trojan.Win32.Monderb.adto upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Trojan.Win32.Monderb.adto
Files
-
40a7ba258400b0fff32455324624358f_JaffaCakes118.zip
-
Trojan.Win32.Monderb.adto.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
UPX0 Size: - Virtual size: 52KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 29KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE