5ad8c2d12557a2f23262308d4e35c6a4_JaffaCakes118
- SHA256 e9eed41b62f5c45e591f6bbf4cfd3559907451159f020ce5a29c6bbca900851b
Overview
overview
9Static
static
7system/ALAudio.dll
windows7-x64
3system/ALAudio.dll
windows10-2004-x64
3system/Core.dll
windows7-x64
3system/Core.dll
windows10-2004-x64
3system/D3DDrv.dll
windows7-x64
3system/D3DDrv.dll
windows10-2004-x64
3system/Def...32.dll
windows7-x64
3system/Def...32.dll
windows10-2004-x64
3system/EncVag.dll
windows7-x64
3system/EncVag.dll
windows10-2004-x64
3system/Engine.dll
windows7-x64
3system/Engine.dll
windows10-2004-x64
3system/FModeX.dll
windows7-x64
5system/FModeX.dll
windows10-2004-x64
5system/Fire.dll
windows7-x64
3system/Fire.dll
windows10-2004-x64
3system/GameGuard.dll
windows7-x64
9system/GameGuard.dll
windows10-2004-x64
9system/IFC23.dll
windows7-x64
3system/IFC23.dll
windows10-2004-x64
3system/IpDrv.dll
windows7-x64
3system/IpDrv.dll
windows10-2004-x64
3system/L2.exe
windows7-x64
3system/L2.exe
windows10-2004-x64
3system/Lin...re.dll
windows7-x64
3system/Lin...re.dll
windows10-2004-x64
3system/NSplash.dll
windows7-x64
3system/NSplash.dll
windows10-2004-x64
3system/dsetup.dll
windows7-x64
5system/dsetup.dll
windows10-2004-x64
5system/l2.exe
windows7-x64
3system/l2.exe
windows10-2004-x64
3Behavioral task
behavioral1
Sample
system/ALAudio.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
system/ALAudio.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
system/Core.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
system/Core.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
system/D3DDrv.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
system/D3DDrv.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
system/DefOpenAL32.dll
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
system/DefOpenAL32.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
system/EncVag.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
system/EncVag.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
system/Engine.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
system/Engine.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
system/FModeX.dll
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
system/FModeX.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
system/Fire.dll
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
system/Fire.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
system/GameGuard.dll
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
system/GameGuard.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
system/IFC23.dll
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
system/IFC23.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
system/IpDrv.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
system/IpDrv.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
system/L2.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
system/L2.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
system/LineageCreature.dll
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
system/LineageCreature.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
system/NSplash.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
system/NSplash.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
system/dsetup.dll
Resource
win7-20241010-en
Behavioral task
behavioral30
Sample
system/dsetup.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
system/l2.exe
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
system/l2.exe
Resource
win10v2004-20241007-en
Detects file using ACProtect software.
| resource | yara_rule |
|---|---|
| static1/unpack001/system/FModeX.dll | acprotect |
| resource | yara_rule |
|---|---|
| static1/unpack001/system/FModeX.dll | upx |
| static1/unpack001/system/dsetup.dll | upx |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/system/ALAudio.dll |
| unpack001/system/D3DDrv.dll |
| unpack001/system/DefOpenAL32.dll |
| unpack001/system/EncVag.dll |
| unpack001/system/FModeX.dll |
| unpack002/out.upx |
| unpack001/system/Fire.dll |
| unpack001/system/GameGuard.des |
| unpack001/system/IFC23.DLL |
| unpack001/system/IpDrv.dll |
| unpack001/system/LineageCreature.dll |
| unpack001/system/NSplash.dll |
| unpack001/system/dsetup.dll |
| unpack001/system/l2.exe |
| unpack001/system/msxml4.dll |
| unpack001/system/msxml4a.dll |
| unpack001/system/msxml4r.dll |
| unpack001/system/npkcrypt.dll |
| unpack001/system/npkcrypt.sys |
| unpack001/system/npkcusb.sys |
| unpack001/system/npkpdb.dll |
Unsigned PE
Checks for missing Authenticode signature.
count=36, id=110, productName=VS2005 build 50727, version=50727,
count=21, id=125, productName=VS2005 build 50727, version=50727,
count=87, id=109, productName=VS2005 build 50727, version=50727,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=295, id=1, productName=Unmarked objects,
count=3, id=114, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
count=58, id=110, productName=VS2005 build 50727, version=50727,
count=55, id=125, productName=VS2005 build 50727, version=50727,
count=170, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=16, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=161, id=1, productName=Unmarked objects,
count=30, id=114, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Unsigned PE
Checks for missing Authenticode signature.
count=49, id=110, productName=VS2005 build 50727, version=50727,
count=53, id=125, productName=VS2005 build 50727, version=50727,
count=153, id=109, productName=VS2005 build 50727, version=50727,
count=4, id=123, productName=VS2005 build 50727, version=50727,
count=2, id=25, version=9210,
count=14, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=6, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=123, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=511, id=1, productName=Unmarked objects,
count=38, id=114, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Unsigned PE
Checks for missing Authenticode signature.
count=21, id=125, productName=VS2005 build 50727, version=50727,
count=110, id=109, productName=VS2005 build 50727, version=50727,
count=9, id=123, productName=VS2005 build 50727, version=50727,
count=103, id=1, productName=Unmarked objects,
count=45, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Unsigned PE
Checks for missing Authenticode signature.
count=4, id=126, version=50327,
count=54, id=125, productName=VS2005 build 50727, version=50727,
count=228, id=109, productName=VS2005 build 50727, version=50727,
count=2, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=33, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=4, id=123, productName=VS2005 build 50727, version=50727,
count=85, id=110, productName=VS2005 build 50727, version=50727,
count=1278, id=1, productName=Unmarked objects,
count=19, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=193, id=114, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
Unsigned PE
Checks for missing Authenticode signature.
count=9, id=14, version=7299,
count=5, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=11, version=8047,
count=163, id=1, productName=Unmarked objects,
count=15, id=19, version=8034,
count=45, id=48, version=9044,
count=171, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=8, productName=Unmarked objects (old),
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Unsigned PE
Checks for missing Authenticode signature.
count=9, id=14, version=7299,
count=5, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=11, version=8047,
count=163, id=1, productName=Unmarked objects,
count=15, id=19, version=8034,
count=45, id=48, version=9044,
count=171, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=8, productName=Unmarked objects (old),
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Unsigned PE
Checks for missing Authenticode signature.
count=36, id=110, productName=VS2005 build 50727, version=50727,
count=21, id=125, productName=VS2005 build 50727, version=50727,
count=87, id=109, productName=VS2005 build 50727, version=50727,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=196, id=1, productName=Unmarked objects,
count=1, id=114, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=21, id=14, version=7299,
count=1, productName=Unmarked objects (old),
count=1, id=29, version=8830,
count=1, id=28, version=8830,
count=105, id=1, productName=Unmarked objects,
count=13, id=19, version=8034,
count=106, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=34, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
Unsigned PE
Checks for missing Authenticode signature.
count=20, id=125, productName=VS2005 build 50727, version=50727,
count=38, id=110, productName=VS2005 build 50727, version=50727,
count=87, id=109, productName=VS2005 build 50727, version=50727,
count=4, id=123, productName=VS2005 build 50727, version=50727,
count=5, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=640, id=1, productName=Unmarked objects,
count=10, id=114, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
count=20, id=125, productName=VS2005 build 50727, version=50727,
count=48, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=64, productName=VS2002 (.NET) build 9466, version=9466,
count=148, id=109, productName=VS2005 build 50727, version=50727,
count=4, id=25, version=9210,
count=1, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=16, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=544, id=1, productName=Unmarked objects,
count=1, id=114, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, productName=Unmarked objects (old),
count=1, id=120, productName=VS2005 build 50727, version=50727,
Unsigned PE
Checks for missing Authenticode signature.
count=36, id=110, productName=VS2005 build 50727, version=50727,
count=29, id=125, productName=VS2005 build 50727, version=50727,
count=92, id=109, productName=VS2005 build 50727, version=50727,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=433, id=1, productName=Unmarked objects,
count=4, id=114, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Unsigned PE
Checks for missing Authenticode signature.
count=20, id=125, productName=VS2005 build 50727, version=50727,
count=88, id=109, productName=VS2005 build 50727, version=50727,
count=6, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=118, id=1, productName=Unmarked objects,
count=37, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=16, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=78, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=90, id=1, productName=Unmarked objects,
count=34, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Unsigned PE
Checks for missing Authenticode signature.
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=205, id=1, productName=Unmarked objects,
count=27, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=96, version=4031,
count=150, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=92, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=339, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=94, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=90, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=69, version=9111,
count=1, id=61, version=9210,
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=69, version=9111,
count=1, id=61, version=9210,
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=2, id=12, version=7291,
count=3, id=95, version=2190,
count=433, id=1, productName=Unmarked objects,
count=21, id=93, version=2179,
count=26, id=14, version=7299,
count=120, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=74, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=3, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Unsigned PE
Checks for missing Authenticode signature.
count=65, id=1, productName=Unmarked objects,
count=7, id=19, version=9049,
count=1, id=6, version=2134,
count=1, id=14, version=8204,
count=9, id=10, productName=VS98 (6.0) build 8168, version=8168,
Unsigned PE
Checks for missing Authenticode signature.
count=1, productName=Unmarked objects (old),
count=40, id=1, productName=Unmarked objects,
count=5, id=19, version=9049,
count=1, id=6, version=2134,
count=5, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
Unsigned PE
Checks for missing Authenticode signature.
count=3, id=11, version=8047,
count=20, id=14, version=7299,
count=56, id=10, version=8047,
count=1, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=3, id=19, version=8034,
count=70, id=1, productName=Unmarked objects,
count=1, id=11, version=8966,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,