e:\DNF\Release\DNF.pdb
Behavioral task
behavioral1
Sample
dnf1.5/DNF.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
dnf1.5/DNF.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
dnf1.5/dnfshenb.dll
Resource
win7-20240708-en
General
-
Target
53c268a6aee632435aa2aefcc0280b1d_JaffaCakes118
-
Size
1.6MB
-
MD5
53c268a6aee632435aa2aefcc0280b1d
-
SHA1
c64b27557e9da349a901347a341bb70fb07094f7
-
SHA256
bbca2ed9fd30539d6d9cb30fe341a0a58292cf1352a762b507a5e094c227286c
-
SHA512
a4ce18cb6277583d16448157fbdfb22972c0625bade7037f0ac11db2088ca2e26b1a3d29db1e8ef2a94483fa3e1b885187baf6322e19a0dfd5b0971f6a49afb7
-
SSDEEP
49152:mjFhIbnd1pn1DU9R8lmEuCtaKP9fgHCXF1sHYDyQ:K8d1lJmqlmn9KPVgHC1qHYOQ
Malware Config
Signatures
-
resource yara_rule static1/unpack001/dnf1.5/dnfshenb.dll vmprotect -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/dnf1.5/DNF.exe unpack001/dnf1.5/dnfshenb.dll
Files
-
53c268a6aee632435aa2aefcc0280b1d_JaffaCakes118.zip
-
dnf1.5/DNF.exe.exe windows:5 windows x86 arch:x86
7a18ec5d094800e233db03af9564d138
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetStartupInfoA
HeapAlloc
HeapFree
RaiseException
RtlUnwind
HeapReAlloc
Sleep
ExitProcess
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
IsValidCodePage
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetCommandLineA
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
CompareStringW
SetEnvironmentVariableA
GetExitCodeProcess
CreateProcessA
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetFileTime
GetFileSizeEx
GetFileAttributesA
FileTimeToLocalFileTime
SetErrorMode
GetOEMCP
GetCPInfo
GetModuleHandleW
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
ReadFile
InterlockedIncrement
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
FileTimeToSystemTime
GetThreadLocale
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GlobalFlags
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GetVersionExA
InterlockedDecrement
GetModuleFileNameW
FormatMessageA
LocalFree
WaitForSingleObject
FreeResource
lstrlenA
WritePrivateProfileStringA
GlobalAddAtomA
GetCurrentProcessId
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesA
GetModuleFileNameA
GetLocaleInfoA
CompareStringA
InterlockedExchange
lstrcmpA
FreeLibrary
MultiByteToWideChar
GlobalLock
GlobalUnlock
MulDiv
SetLastError
GlobalFree
GlobalAlloc
VirtualProtect
GetModuleHandleA
GetCurrentProcess
GetSystemTime
OutputDebugStringA
LockResource
SizeofResource
WideCharToMultiByte
GetTickCount
LoadResource
FindResourceA
GetCurrentDirectoryA
LoadLibraryA
GetProcAddress
GetLastError
GetTempPathA
CloseHandle
GetSystemDirectoryA
WriteFile
HeapCreate
SetEnvironmentVariableW
CreateFileA
user32
RegisterClipboardFormatA
PostThreadMessageA
UpdateWindow
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
CopyRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowLongA
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
UnhookWindowsHookEx
GetWindowTextLengthA
GetWindowTextA
SetFocus
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageA
ValidateRect
CopyAcceleratorTableA
SetWindowContextHelpId
SetWindowPos
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
PostMessageA
PostQuitMessage
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
ScreenToClient
SetCursor
SetTimer
GetWindowRect
FillRect
SetCapture
KillTimer
DrawIconEx
GetParent
TrackMouseEvent
WindowFromPoint
PtInRect
CreateIconIndirect
GetIconInfo
GetDC
ShowCursor
InflateRect
InvalidateRect
ReleaseDC
GetSysColor
GetCursorPos
GetSysColorBrush
IsWindow
ReleaseCapture
CharNextA
CharUpperA
MapWindowPoints
LoadCursorA
DestroyIcon
IsIconic
LoadIconA
DrawIcon
SendMessageA
GetSystemMetrics
EnableWindow
RegisterHotKey
MessageBoxA
DrawTextA
GetClientRect
GrayStringA
DestroyMenu
DrawTextExA
TabbedTextOutA
UnregisterClassA
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
SetRect
MapDialogRect
IsRectEmpty
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetForegroundWindow
GetTopWindow
GetMessageTime
GetMessagePos
SetMenu
SetForegroundWindow
GetWindow
CreateWindowExA
gdi32
RestoreDC
SetBkColor
SetBkMode
SetTextColor
SetMapMode
GetClipBox
LineTo
MoveToEx
GetObjectA
GetViewportExtEx
GetWindowExtEx
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SaveDC
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
CreateBitmap
GetStockObject
GetDeviceCaps
CreateRectRgnIndirect
GetMapMode
GetBkColor
GetTextColor
GetRgnBox
CreateFontA
GetTextExtentPoint32A
GetDIBits
Rectangle
SetDIBits
CreatePen
CreateSolidBrush
BitBlt
DeleteDC
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
PtVisible
SetBoundsRect
Escape
RectVisible
TextOutA
ExtTextOutA
comdlg32
GetFileTitleA
winspool.drv
DocumentPropertiesA
ClosePrinter
OpenPrinterA
advapi32
RegOpenKeyA
RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
shell32
ShellExecuteA
comctl32
InitCommonControlsEx
shlwapi
PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathFindExtensionA
oledlg
ord8
ole32
CoRevokeClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
OleIsCurrentClipboard
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
OleFlushClipboard
CoRegisterMessageFilter
oleaut32
SysStringLen
SysAllocStringByteLen
SysAllocStringLen
VariantClear
VariantChangeType
VariantInit
VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect
SysAllocString
SysFreeString
Sections
.text Size: 219KB - Virtual size: 218KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 537KB - Virtual size: 551KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 54KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.0mp0 Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.0mp1 Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
dnf1.5/dnfshenb.dll.dll windows:5 windows x86 arch:x86
32bfd8410ba2425372701cbf398d0cc1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
FreeEnvironmentStringsA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
FindWindowA
Exports
Exports
ama
amc
aq
bjz
bx
cps
cqp
css
cts
dgs
dns
gbjz
gjs
gnd
gns
gqp
gsd
gsss
gvss
gwd
ips
jbg
jc
jf
jfv
jjb
jm
jmp
js
jsb
jv
qa
qb
qp
qt
sa
scss
sma
smc
sms
sss
wb
wd
xaq
xl
xq
������ŭsĴ�>J�+�BJ��_�oِ,s6HxwH}Ck'q+o�������f��˶(���^�x�g� }T�y=�XA����q%{��b|t���\��Kƣ��%��ۯT�dl���^��`��Ųi���8=� �ԡ�y8Ŗ*ގo�ё=�Z� Eq�� DwR�7VCE=��匸_QM��+y�:}�:*u[��x/��||s�%����c{�I�jX#w�y� �Y�`�}��N$[uR$����5d-%����+a��/�]��e���P�m�~�(���h�$_5Э��� ����j�/w�B����a����s�O�h��l!�N��!-/�T������~5���&ju+���M /�0��+�\�:1%)F��.VqU>߱RӮ�ϐ|PB}ׂ��v���!r&r˟��3�l��k�d��]4n��f�~-�)[&]���%)�@n#����S4k�����:�����Es7m& �Y��/9��lD��=�H�|�&6O��2�h~ �_g�b���erMQd�!�qл�ٽ��m�xYI�*L����RnM���@�R��v��9_���ua�w��������+�߈#&�"�}U���e�mt��V��E��`i�#q$?c�hD��Fk�%U+��/�s��Rb䓑���0�A���T�A$��\��_�92B*d%�%�X(H���`�[bs���p�Sam�M�ܹ�w}I���T#��x2���u��� :z8��BX&a�$y5������@Ɉv�[���9L�6�?��s҄^��Q Syc��ٱ˞�]�5��ݨ�b�p3���}t��4$�z� �Ѽ+UX۞�`y@��?��N�"S�e~������Z�T���0eA�W���u�ӗ��1l�Ǩ�-!nʤO�� ƔI��B�)Ǧ"& 崐�3m�Q��SH- Y/Xשv���.��CƏTJ�� KN/�@�"Uq�s/$_ d ���s�Z��7��| �~Pq�ŅM���������P�V98��d��~2�MB��FhM��ʛè����K�X->�~iԠ���B��>p���^��%G?���x1�ȪD>2������K�?�o�>��~����N�����1� Q�h��wHk��Pl��!'�������i��*!'+ �#�1ϱpucm&:_���S*�)]Զ`�Ӵ,P�Y�N0x]1L|4Xq.�h�Og���:���V��ȁ���~��}�/��Qƀ6K�:���@������C<�do���x���W/�����Oլ�fλ�KoE�����"n���Z�;�Ae�֫�w�S^?�mG~����lv7t��R4sK��,ED|�2.I��p�;���Ր�4�I�f��Sk�s(û�\���Aqù��F��\���㨸7-��\�"����;�X #sÓ���3�b���8Ek Ghd��T���������ʖ�u�m���!�rg�/�Y�$�r��������>#t�9OL����Y��ǧ&5b���Ȍ~,!�w��(�%�Nw7L��$��O��n#r�KUn�Kg��9���0QV����c���� ;h��J4�X-��SpFX��a�pl����A�H?+�p3x9�U��@�:�߃ 8� ���_��� ��%*���Ier q���O���P��c�ػ� �\� �I��'o<�����0�MO:�n~W��H��`���N}��.�@�q�F��x�?#i��9��Lº��E�=6ԣ2�*���9*�ZN�D51<Ѐ5�W�U�2u(����B�C �:pկ��`hVpz��:g*}�Ҥ3Q�މ~ކ���"]s>/��ш_zm�H�icQ���� Ҋ���{�>�R����3�����HC������W����暬_� F�������`�û낁���ǜ� �3�m����g]!\�ޭ���B�~F{��࢜��p���:F0X�ۖe�p�9tF����'�p.���� ���w]�.GT����}eH���{e� K�>��}�|F)��: >^�-��]lj���1 8����G�SsКI��Z�<GgۮA���:����5�� W����ްS8lg����>h���`ߤ���/���kI��@6sc���&9�a����M�>g �w����A@F=;\�hгR�6�{��mP�OC�������"f�M��_y���3ˈ�#�&lH{IT���S���T}}5W��p�1�}T�V�F��_f���ļg��gsϊ�Rw���m���psL���$�=$6M�9.�װ��r�[�ʞ+pz�L?�y�!�P/�G��)h�c��Ui�|� ��ˇ�⣧3�v�$G�S7�Vz�谅�4��m[W��-���Ҡ!�����092a��V�����=�acWC�����7���I�R*<���Ӌ2H�ى7E�d=��9�d��HhZܐ��}�Ld�G�y9�����-�M R�C�w�%:e�>=\`���RA�<��珞|�BK�{A�M��� Tr��Sn1`p� ��3#�ȋ�l���#�" ���.*!P�?a2��R�g[|a�ɷ�*4��}� �P��s��i�����Ͻ������2~92�H� 05x�҃����1c���U��u��B��P���x�z$�9��n�X_�����\�?Fߜ��'�7�B;%��P zy�֠6L](��Y@�n�����X\��)nBz�����s��=���!��l/2�-�[oR���r����A������P����}�\���.3r�͐�>w�Z����g����I��.�e.7�_�tzKrc��!6Ӊ�%u�h�<s�w������Y����T��0=k�� ��� �?������*�e?��!�W�x���4.-k�{�w<haj���X�k�I���v���d�8��-������2�@����Pzw N[6��O��L��黣^S����̦���T���Z"a��O71�4���m�\�[;���mg���>�c)�[���rZGz�:Y��Pj�?��O{c��+V��MPI(�K����T��if���]��!�G*s4,+�N&݁�{3V��=/EH�
Sections
.text Size: - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 887KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 336B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
dnf1.5/˵.txt