y��Y�F��E �_������ztE��qӍW����e�`n/گ�Tϒgޡ����|0v�W�v�A�������c�Jh5f��n��ۘ����0�er�S:A�F�6��b�+S��@�0�J�K�3�sb��qZ������CM��G��q > P[��*�yg����2�v�u�;h��@D|ּ��$���XO�<D�Dٕ�[iWk�?Dy;h�a����,���<���e��?�:�-Z�@�ρe�ߝe���~el �^@��.c���Z]^ ,��%�$˂��6ä�P�A��^1�5��np�T��_�)��_�2�${�zL[+h�A.��F�k$u���f��r�.����8�}[7�������k:��`^��]S�ǖ��FE\_�A ��7T�N�=�Z���W��b���^�Ұ����OC�i~��0��z�� �v=���M�V�CU�W�;:|M�v��5��P�a���x��10U���1�I@=�:%��{��5<����5uUS"h������-�D[�^� �&3�Ż8� ��$��P��;J�n6��� �la�f'<�k���CM�~�:̵�g @R���\�M�@�Rʢ����U��L������r9��̲*�O� �ͱ��?4�}mro�m0��M�ͅ��� <�oSu_�h=R�烍oWWh�<(��%ǺJ*O6��:�O6��uHX/l�0&�e ��`~��B��A��]�@e�fE C�������ɮc���]-m�@,q����+a�$�u��$�Xv�(��q�������$߲��z�._���F0�<�LG(��]}nYB}2q�C������-3[����+��³���Η������s�����f�ZUx탪EYL��"A�IT�9.�ID��:n�}�,��P+��0�=~~X��7�9��#�x!�s7� ��z��O�e����e�ӝ�j�x�n]'�,�8h(RWa3C-������[I�I��J�=���8=QH�rWAnp�v��w�#���"���8�Z���_����0V̒yc��e7� �R���;�h���E�y������}�g$� Q�����$A��� �Y������_ ?��y�!�m����ha�:�YP]ˣ(���� aG�߭86�.�J�JMD��Z_�Ё���w��/�h'����5�y�!�D�b��0��:��n�8�"gg���Nky��Zkf�>68R�KT��N�v�ԩ��K�r�L��h�yh��40�<��nS\���,�L�X������_�8 ���w�Б��C���Xg]��XŦ�4����Ym��a�'��]��z�3\�A"H�j߹�'�˩�"������_�? %E^3L��2����������5�y�O�%T$�����J�a�Ƙ�T6��Qy`gX�� Kac�G�L${��"����~9��_����9Z6�#R�TYg����y����(q��4�4����YW�L!.����3:#B�͎t��}R@�ϙ�EK��[*��z��h���-�t�1|��#�B%��<zx��l�I&B�C�ȝ��݃]���:.��4�%0�iD�I� C��:Z?L�������������('���F��Y:����1/ou7���j��nI������_���������Q)����+���[(��\��ھ�%F����r�*���� U ̿[�l��fS#S�����9q�Df�YRՋ�C�%��J�z,}�V%�i~W��hٓ{��KT� ��Z/�+���S��0�5�z~��� �����%ejYnDr�d^9�\b^$V�W��3{������o�L=< ��x��x���PO+�L���-b*-�� �������T�}@Ѯt������{"��˚��I V��?��I*��8=D����6�{�D�����c�㑭qtU�1B8'k3͡s��ߢ��Lk@A_�(��//�kܨ��y㇚�g����! X�K���� ��<dL���nKӆ�=���so�~�#I��xR&qUT? Elو����o�{B��p�#x��`8�Llc�l��љ@�nPҬ�7��˺�qxO�-e[�-�ݴ��%h|)Es��[�E�3^�;y�T��#�����x�8\���u�=�\�A�&�����*�X�@3K2�;Ud�F��.��I��+�b#��n��`*#����++D�]͞�)�#�/C+^!�'X��z���㊟�r�Vz�(�(�b��NQ{�^2n_���߾?�(h�^��鳓�G�&�̎�j����� �3݊�~ �a(�h�y�R���o}�M�Km}i�Z��U)U��2���p~�P`��� ���T�sJ��$尕l�q � �U�T����v� -��0v���Q;}7~�d����f�=�jiEu��BG},���,�u���D⒰q�)����ege+�~��|?����a�ic��^2�ͳ�5EX�$ ��Ȼ�ȏ��[U��ɂ�e������i�)�|������|P��9�@�h�0�B-���{���qw��/�"7xH�������\�T�~��A�J��w�� ~ӄ[���� J�R���u5�ܰ ���J��#�e^���fHc7�M��aa#Нt���Y��|�M�:!�c�Q�%�<��Da�G3v� Lf�}2�P[)8�����U#82��ы��\�]���_9���à�&ә�4ķ���rKX��+��g��+���4W/�ž��V)��(��ʅ�^L'��������3��6�.��F��}����0��C&�lݲ�&i���s�ˆ^�L��|a�]\��#�0�D)���G���p�v1rs�� ����{|�F����H�45i�$H3��_�� ��z��{���{6�7�m��`�����ܡD����&)m����6:�27��^���WLy�J|�4���4��lB��#��δ�jɤ�5wu3��O�p�PG�r>���|��^�5ݯ���Gш��a&.��4<��.Q�Q�z�h�@y�O�'T&q-K�l�ġ�F�ޜ�gкӎrV�n����Z/Z����Ȟ)x�� +I�S�4�����6���R2؏G8���
Static task
static1
Behavioral task
behavioral1
Sample
MapHacKTw}Ϻ.url
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
MapHacKTw}Ϻ.url
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
MapHackTw.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
MapHackTw.exe
Resource
win10v2004-20240412-en
General
-
Target
f965644f58adb5b28a07480f2dbb3f08_JaffaCakes118
-
Size
866KB
-
MD5
f965644f58adb5b28a07480f2dbb3f08
-
SHA1
6bae19413ec967b21e9954df9132abe44531ce7f
-
SHA256
e421b4a27fc13f36379dc736991e9c41de9c479b8413b3e8b04cc82880e4d705
-
SHA512
c112af6140ca98872959ac8d418f459842714fd9f1b6148989c152973c251633e4bf7aba2e02c46ebce7188bb02dacba7ce2250397c8c88c4296bf13d5bffc76
-
SSDEEP
24576:BoejkfW6Ael4ricHbcO81tpl85RrEMZLedqJssU:BoejkfWLelUL7cdl85ZLHGsU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/MapHackTw.exe
Files
-
f965644f58adb5b28a07480f2dbb3f08_JaffaCakes118.zip
-
MapHacKTw}Ϻ.url.url
-
MapHackTw.exe.exe windows:4 windows x86 arch:x86
599888b4c8a1db40dc655dbd056a4036
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
kernel32
GetVolumeInformationA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
SetCursorPos
gdi32
CreateFontIndirectA
winmm
midiOutReset
winspool.drv
DocumentPropertiesA
advapi32
RegDeleteKeyA
shell32
Shell_NotifyIconA
ole32
OleRun
oleaut32
VariantCopyInd
comctl32
ImageList_SetBkColor
oledlg
ord8
ws2_32
recvfrom
wininet
InternetCloseHandle
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 696KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 187KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 427KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ggc0 Size: - Virtual size: 344KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ggc1 Size: 852KB - Virtual size: 851KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
ϥλ.txt
-
H163B2}Ϥk.txt