贇��ӉHxL<����<��-����z���<�?�;h���K< s�|����*�Xr�@K&(���Y����Ȩڨ]?�[����?�IZd��cM[mx�)�} ��1 ��7����B�+�w<ܾ$�%�lj$�>i� ��S�4����vCj[��rQ���'mt��#Y! ��џ�.��y�=����g�i���,[6�D ��\�(�eS�+�s�ԏ��0v�e�����:��֡�ԥ)4G���m�{K�cjX�miP����Ui�U?� �xugW-�YD��У#Ӵz�ޘ��`C|�t��$�1���?����~��ԅ,'٭8Wa%n(+��m�Z�����%C�`l��}X��@d���<�� �-�U�IV�{����5����70iC�T&rlDet2�� �;?>?�}'��~ J�_�n�Q8�3o���BBM�#%�)��o.����G�lx�vWm�fF(���f���`7�eB*d�@��kd�H<*��2??�+T�ɉ�v�pV�>C�=晱��|mQ��� �HK�Eb�͖��R�AaE�N�$Q'M]��%��/���B�@q�K�3���<>)�*��\��#��]���ʑ���oã�~ 3-k�\�i����}ٷ71\�[-^�)�h��u^�W�U�p��t0�8Z�Q�F ,��\(��3��F���L���)4���=`#(��4�آ��P����*����dT�$��m)����]��h�UHv��K�)��P��0�� �_ ���}}��0��x ���m-�� ew �{��T�)����ZXd��(��)��9ԍ�#(�r>��K��ԭ�D��X ��*c�^o��h�F鬓 ��U���4�E����z� �˳�P˿�ed@��0�����R(2��t��K^{��k�*Ą�0�Ѫk���|�KK���/\TO:�2��=��-7ao�h]#lc���=Vf��%� 1L[F�w�n<�藈| �sI+q1!����x���Z[`gL6p�>�Er�{�Z��ry �E����Vj�TQ��؉5/n#A��1�|2͑�v��Q?Lg.o��ۓ�OD��a�-�6ڻ�^y�D�:��L�J�Z���\(�ǁ��!uD��~{��9:=����e|��خ?�Fs����$����R�2>��d��o�q�d��3���~�!��حt,o�C4�5v��|h���0a����:!P��gV� �;�!��*Md�I��m(|0���x#]��y"Y���Z��p ��>`�E#��b^�DS}` z��uFp*w��t�W�k�w `�&����ζ�y:6�u�!�.�X�6��#0���eH���<ܑ�l�j� 3��\�-�z�2�N�ѣ�d�R"�[��B}�s�z���_�\v7=3��4q;G��YJŹ��cJ�X���ڳi�ɯ�ƻ5�<n���\#�594��3�����Ϟka+86D�=�K�ST�1��^��f-��})�yQ������G�;O�ΟbJU�+o�1 ��G�W�C�?���n�\J1���o� �K��5� ��Ve0��:�Eݟk #5"�J2�{R�~�1�������{��)\Yj�#�y�����ϏX�a@\f�!+PM�{PW�:H�ʁ�ek��X�F%�{��^Q�w?���~|iటs��L|���tI'�7��?��P�o=����{�?p�D��1�- ܀C��X����ٴ�ν�Gfґa���WЫ%�o/���V��l�*�陾A6L �N���P)��W��0�X�4���o:=WE!tǛ���˂1���g:"NA��U���F5$�N��T �h����L,G��Bx&cJ�ƛ�Ic{��G���Qo�Q�n:q}�c��%�0�b�`f���<��Oo�1��K&/�X��Y=���F� 3Nn�vc(q%:_�&��T��5V���h��O�g�L���o�S�������H��(Ҡ��͊�ʲZ�9���A�� b��m�t�Y��-$�?��F�������. @{�N����/�'�_���A3�E>�V��zeRy�?&PK�G��ta�Щ�G��9##y`��N8D|«�Wq_�7���c1�����]dz6@�SE�#�l}I#���b`���������iP�� �%'Ӻ���!���oTs������ϕ����M)���)�\-C�!gb��7r!��-6��~o1��bũO}�thX���{\��E\@�zQ�f��Jęv�=����]a�w��f�)P[]`'�ث��E��&\Q+In@b���P НѝDDL՜���A�;t �/�H?jD��� T�-�}���sqV�����V�Tq����;�i�������u0tjx� �g P�]�������Yn�$�� �� a0[�}H����?��V��:�2�W Y�>�L�fI̘���ؘT0�G��r�aE�aO�Z��\�f��| �UD݊�e�[F��(�l�ۜ��G���u�tEx����U�6�� Le��>.�w�C������[��Oľi|�{�|�z �{�-6LdL� o!��.#��� SM��غ�b�є*��Wc���0k��IIJ�'P{���{P���e��'jUş18>r�|1�����o �@��tƼ��Y"�Zӌ}t���O��Y�H�ɡ���lQ����+c���! �X�̗c��rVN����9u��ga7��*�E�HX�ݹN�%����SB6����h��J/�J-66V��\��W �L�����8�#���'M�a&d�{Y<k�|�\��r/Q��Zc�F�'��/u��,G�� ��H��DS���G��;_#�M��$�Dؗc�"���`Ԛ��Ѝ4BH0S�g�59�-Wy�2+S�Wj�?����i���{1� ��3_m���eʎ3�j�cM6����RX4�偮�3���9�\�0ə)�bU������ئ'��gI%��!���^�<\�?�!�M�'*�<��T+$mf���h��_����O �^Hvf<V���ڼ�zur&���\U���?"Z���9V$��7�9L%��C�t�����,t�K�vz0$ˮ��<����H
Behavioral task
behavioral1
Sample
新云软件.url
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
新云软件.url
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
歪歪团队刷花辅助.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
歪歪团队刷花辅助.exe
Resource
win10v2004-20240426-en
General
-
Target
6321e4cda46b348f3f5acba99c00a686_JaffaCakes118
-
Size
1.6MB
-
MD5
6321e4cda46b348f3f5acba99c00a686
-
SHA1
1eaeb662e2ae22ea90df6bfef1ec61dcc1918211
-
SHA256
dec719b460f471670e42d1174a2405706063128b81da992dda953223212e6065
-
SHA512
bcb07da3d3ee7f09f1aad73bfb9429b11d7eac1a6776498f43c34e5253d73e570b2ce876ed91a752c94ba1a0d6f6658dc6cf1e6ddbe600d278d6569663a37171
-
SSDEEP
49152:+dhGeS7PVefIo5v03Cpv1/L4FhUOnfH6HQW:+dhGn7deAoOSp9j0CO/CZ
Malware Config
Signatures
-
resource yara_rule static1/unpack001/歪歪团队刷花辅助.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/歪歪团队刷花辅助.exe
Files
-
6321e4cda46b348f3f5acba99c00a686_JaffaCakes118.rar
-
下载说明.txt
-
新云软件.url.url
-
歪歪团队.ini
-
歪歪团队刷花辅助.exe.exe windows:5 windows x86 arch:x86
97b428a68f4fd993251d64518477bf6f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamProperty
ws2_32
recvfrom
kernel32
GlobalAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
UpdateWindow
gdi32
SaveDC
winspool.drv
ClosePrinter
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
CoRegisterMessageFilter
oleaut32
SysAllocStringByteLen
comctl32
ImageList_Destroy
oledlg
ord8
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 767KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 732KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 945KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 84KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ