C:\Users\Admin\Desktop\imgui-master\examples\example_win32_directx11\Release\NIX ITEMS FILTER.pdb
Behavioral task
behavioral1
Sample
NIX_GLOBAL_UPDATE_1407_A/ITEMS_FILTER.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
NIX_GLOBAL_UPDATE_1407_A/ITEMS_FILTER.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
NIX_GLOBAL_UPDATE_1407_A/NIX_ARAB_1407a.exe
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
NIX_GLOBAL_UPDATE_1407_A/NIX_ARAB_1407a.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
NIX_GLOBAL_UPDATE_1407_A/NIX_ENGLISH_1407a.exe
Resource
win7-20240221-en
General
-
Target
685e7a0b83cafc668a666d43588bc997_JaffaCakes118
-
Size
10.5MB
-
MD5
685e7a0b83cafc668a666d43588bc997
-
SHA1
3a7ed0dbeef228251a2c286795a7244c53fc34dd
-
SHA256
c24ab8395d07ca9e1aeb1f3a108764cbd1a2245bd30c57f4c26a2adbb00206d5
-
SHA512
96f701067a6f5c4f152e7e5abd0f47eb1cc1066bcc29bdb547d682cf791a18bfabba8b9bdc14d296340c4f710596dbc945ec9e98a6f0bcce38bfe5ca39d2eac5
-
SSDEEP
196608:7DaIRyPiOhSN8go+QZiPv25ezWpBg/d+qUv89wRQamNLp9ftYnK/T7olPK:nqPDhQ8g+W25eaped+qk6amBp9anK/f/
Malware Config
Signatures
-
resource yara_rule static1/unpack001/NIX_GLOBAL_UPDATE_1407_A/NIX_ARAB_1407a.exe vmprotect static1/unpack001/NIX_GLOBAL_UPDATE_1407_A/NIX_ENGLISH_1407a.exe vmprotect -
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/NIX_GLOBAL_UPDATE_1407_A/ITEMS_FILTER.exe unpack001/NIX_GLOBAL_UPDATE_1407_A/NIX_ARAB_1407a.exe unpack001/NIX_GLOBAL_UPDATE_1407_A/NIX_ENGLISH_1407a.exe
Files
-
685e7a0b83cafc668a666d43588bc997_JaffaCakes118.rar
-
NIX_GLOBAL_UPDATE_1407_A/ITEMS_FILTER.exe.exe windows:6 windows x86 arch:x86
fefe5ac1e3c1155c0e4067bbc086f59f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
imm32
ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext
kernel32
SetEndOfFile
IsProcessorFeaturePresent
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
QueryPerformanceFrequency
QueryPerformanceCounter
GetModuleFileNameA
GetModuleHandleExW
Sleep
GetModuleHandleW
WritePrivateProfileStringA
GetPrivateProfileStringA
HeapReAlloc
HeapSize
CreateFileW
GetStringTypeW
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
OutputDebugStringW
GetFileSizeEx
GetConsoleCP
FlushFileBuffers
LCMapStringW
HeapFree
CloseHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetProcAddress
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
DecodePointer
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentProcess
TerminateProcess
RtlUnwind
RaiseException
GetLastError
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ReadFile
GetStdHandle
GetFileType
GetModuleFileNameW
WriteConsoleW
ExitProcess
WriteFile
SetFilePointerEx
GetConsoleMode
ReadConsoleW
HeapAlloc
user32
SetClipboardData
GetClipboardData
EmptyClipboard
DefWindowProcW
DestroyWindow
CreateWindowExW
UnregisterClassW
RegisterClassExW
ShowWindow
DispatchMessageW
PeekMessageW
TranslateMessage
PostQuitMessage
UpdateWindow
GetKeyState
ScreenToClient
GetCapture
CloseClipboard
IsChild
GetForegroundWindow
LoadCursorW
SetCapture
SetCursor
GetClientRect
ReleaseCapture
SetCursorPos
GetCursorPos
OpenClipboard
ClientToScreen
xinput1_3
ord4
ord2
Sections
.text Size: 304KB - Virtual size: 303KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 73KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
NIX_GLOBAL_UPDATE_1407_A/NIX_ARAB_1407a.exe.exe windows:6 windows x64 arch:x64
dccf1766c543aa44eab2d7f5ebf09a37
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetVersionExW
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PostQuitMessage
CharUpperBuffW
gdi32
GetDeviceCaps
advapi32
CloseServiceHandle
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
dwmapi
DwmExtendFrameIntoClientArea
d2d1
ord1
dwrite
DWriteCreateFactory
ntdll
RtlLookupFunctionEntry
wtsapi32
WTSSendMessageW
Exports
Exports
81���ǖ�!�n�o 9�4���q��[~R��X(k�\{��W�7�Y'�����)�.,~�f�L�Bm8�6�"KAt��Z��p�L nϠ�;gNY54���ؤ� ڀ�L.�T�p�I�����b��Tq�����t@�I�Ɂ�lՖft���> d��̮[��8��17����my�;���ꝑ�������^������5� �������0����o��N�Q;��M?���?7�J�|��/��7sW2ˇk-J�%���=^��x7�":lxr��k�o���w���=��R��`�S�ò�u���ƨ�hr^����5;�#v߀%�����e��&�aj����U�TfHϔK����X��}>9y#:�&��?e� 6����S ]�/¤fd��Sc���'��9`U/P�fn{�$��M�-\B�*_�Kt�$��l���jbӴamP��kh�T1Ɍ�� {t��}�_�|�W�Vw���qռ��!�f�]��Ji��8 )OF����PI%q0�/�����e@��2����F��i+J�R�7*��:�nΠ0��_��;X�*%���6�^x��h��kXP��R"� #�q���&�{A��n��y$?!�X����{Mihh�q��D��Q��?O�S���l�z̀�����y�#����]�PM�#�D���o���V��[�b���M3)�m��`,��y�y���-'fT��Zu+P%䞣��#H��:��Ye�_H��X��±�H�J#�C�Xdw���O1�s�m�la�4Z�&���h�_g�4��W"�[�fK��'X'?��wV����4v�bWf���D�pL:�o��TںO �IGC.As2u� � ƴ�1��S��*tI��S��B� ��KQ�̃���o�HЙ���Y�V{��dR��yv����*S�E~�c���52N��ڌ�]~.w�0����kͳ_���l6��F�i�����?(s�N��v�Jo�� ��Kh�k���.�(�B���vc��ukWb�x�^�&R����n˨l��ң���E1F5�I�J���́2 �# �*i(MR@�ܺ5l�'�˳�z� 0 �*�ʋ��]��^�5Jf�S p Sk\��eFI���ma�Y���йed�|-0�����A_/����G� ��`^JS�'��W�@O��*uXTs���d�|���q�p7r?�m��/� Z��ڣzr9)�_e?+^d��x��|Ͷ}&�Z-���"�c4L�Rd�i���t���8�b �|�&_�6�[�m��G�IV�P�������߶_C�����_[R���?v��C���eM9�*G-uh^ʫA*��T'���w'�J0��{��H*����E�S�w�VY��mN���iQ����a � }�G��Ne���̶�nߟ��p���0��z���5�\{�Zz�����Ua2�*�����u>��A��i�,8u�i8 H���ˎ�R����m���ӌe��~y0�?��$��Á1��/� ��FAO����.�=��T2���-�\���`,ɓ��ݢ^�uD�>���OD���Y��1]vi����Ij�n)$��0b�0M�U��y7.��h��tR!c��k�9��[�ˑ���?ǀ?p_�P����p�.�$RwAa���t��'�����z �i��vJ��D��; Q�(o�$�l��TT�3tg�hN�$�f�Pk�7�C�f� ��"�ɓ�AI�> L5ӂ�~L��F���$l�BQ�S:�{�ON��(B~;�ij4�����4,JN�P\�j���x!�ϵ����!�=��i��S���"�o�FN!��C'�X�� �w�%�~|m�9�A�M���+3�.�.�Ӟ�)��B�P3x-�SY��V�֔�O�X;��M�4���]�i�{���������@8�����i9�!����s�"%����N��6�;�Q�)��hso��%��+�>�l���ޯ�c��D�f�͏G�K���P�A�tr�y���)e�ڐR�i'� ��*�GR"�%���6|�H�y�7�p����V)�ɃD��f����qL��h�$0��~�.�s��rH���1E�[X�'�d�'X�Ndg��d�m9�6u��|�ia��}4��1?s����n$��.���@���ou���Q���_�9�DU�ԥ��+#��J��SSD�� ]�ŬP���j\]6F��D�c��>�`�rapcp�<_[�� _ ����f|�ɼ����mL6�m�e����VB�^�Q��P����J�!h�Sx����F�l�pkeAeգM������PupE6O@R�h(Խ�^Q�Y���%X��9��TJP��-��X5������Q�K�PUьT�������<�.���;8�ÄF@�e��8Y��!G-Gy�������>C:T+I��#�3^� �'�D�M��� b#'�������R<B�1�H��%^��jA�ڶ�iK�W\���!%l���`�-jG���ߦ�G�S�zŵ`d:��,�����6����D+?�Z�߱|Z��������y�>�" gL�`ٽB}�_L��b1J����WV�'�����JA3�@d4���Dʲ��0�nhL���T1wW�1)��$��М&#���P�&��4��t��$M�wbhJ���@/�����h�b�����yFpQ���V:���W��L&��G[K7<�o_���{���R�h�����lEn�.�duڕ�1$c����m�Vs��3�9I��m��UZ�w��?���]ǙA�J��b���a� ����Nf�D���MgF�n��Ki�U�IHYE��i��� �!6�>~t�"�w[��B��]<�C.[C�F<fI���+���&~5Ѓ�����C�6��5�]��y�ꪷ����Jw��A�KV��~٬��?}�4j���gQ�LF����)FRU�%�5��%2j�0��{��~��W��ښ�rgW���ZC���7C�-�aV�H�3ׇE�hw�j}�EWg��}��}�GK*\Z�#@UP4L(�L�����"K6�L�s%���^�'V�
Sections
.text Size: 460KB - Virtual size: 460KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 250KB - Virtual size: 249KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 666KB - Virtual size: 665KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
NIX_GLOBAL_UPDATE_1407_A/NIX_ENGLISH_1407a.exe.exe windows:6 windows x64 arch:x64
dccf1766c543aa44eab2d7f5ebf09a37
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetVersionExW
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PostQuitMessage
CharUpperBuffW
gdi32
GetDeviceCaps
advapi32
CloseServiceHandle
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
dwmapi
DwmExtendFrameIntoClientArea
d2d1
ord1
dwrite
DWriteCreateFactory
ntdll
RtlLookupFunctionEntry
wtsapi32
WTSSendMessageW
Exports
Exports
V���$'{DA��$l�n܆�4�pa�!�6��O��"�i q� �x�ዧ"ɺ����'@t��9��`�=����)MR�� �ˇ���d��k���j��.�����c����l&�#5���}���7� �Yǖ���c�e����p&���B">T&���-��yEzE�9�������n'X�ė����$q~���S�UnXS��4RM���w���gsZI��$7P|��0�{?-���j�����Q T����*E��{v��+$�p�)n�ح������k��E�X��|��Ͽ1�G���m��WdI8�g����m��!�{!x�q��*�2�͈��y�����p%�n�`�9�z~�Ꜹ7�2 ����oϽ��}�V�b��Z QyK<�#f�����搏[��l�i����V�-0>�c "��,�Te��5������I��D�M�oޭ;^�[&����:1�=��]ّ����M�5#�t���;���&�*��y�)~-��}��%B�L涩t�㺲��t�Y)��k��������9�'�Ep.=�&�xY*��.v�fۙ(a�J�w�K7�D�Ȧ��'�,�d���Q��Œ& �Z�W�>Ѝ.��;^�*�X6r�iF��]��������͑��f`���B�V�(qPE�r�� ��3�';@�Σl�^���7��cV�� '!V���ά�zqUõW���6���a��}�����<��5/r��7�� �vO�BF�o�$D[%��H<Rr���fp�7[� �f�@��~"���� V^�����r��3�9�?քq� 6����|��Kg�cHU]� Ʋ��g٧B>�{��}^�./y|Y�=���o�8����H#���e?��Ԏ��k��x�)�+�BR��2�9�ϣO�Q.k�1�a�Bْ?�ߠ%&9�R��J:�����zs�V�uo4��RGЂEcʶ{����Q�q�LY���Z��E/��-�K5�M^{������^��N�Ȧ�G������:�Ca�]�3XF-@UuU�L X��>:0�<wfBS��yw�L\ԭ�O����y�$���y��cA$f�j���~C)Yj���w�W#��8�5�k`�.!�߉�q��l[�a��ҿ�߾���=8�Mkݭr�W.�� �j S�c&�<`�ѝM�~�����~3��D|�+�[�`�QuR_�=�膵����uHbؼoբ?��w��_<.;�>��#�b�y�F�.�Q�����?�� _�}}O����@�R�2D4"�YQ���43�Cn��|����AU�(��^`�+B���A�t()7p�Ǡ�_�Li�O��1�CY��V�0'��I.\�Ms�����X~�u���%��˃b��Ň�l��.���������Mn�2C�c=���S �J�|W��2�Ek\��I�펼�)����n�W7��7S.s�2qO�^�i|�q+�������0+�4�I~*>{���Y�ݵ:um+F�M�;ͿVX5�?��zo���뙕6����a� ���@�~J�&��"7��5��b����PV�/�*�����d���y�d#皶�S)�jjB����.,3|� ������\����ap�N�T��<��M9ֳ�g*�[�V!H��hЧۈ�e=pD-����^<)���o�(]���:M���u�$���#��J�>4�o�G[u�w|v�0-kHPd��ɝcYA ���H��P��0���ɛ������m4� o���ܬ��"�EJ�xU��⊉'����� �A�JdO�Q7�;_�����M��!�3#u���c/�.�X^�Җ#m�9������C���_�k�V!�@[4qX�]r���tA)ޫ>0�F�V��6Е�{@*�1�̍��A�MZ&b��L>J��[���� h��v��u���kp�tUG�s��)1ܹip���ʷQ���a�}�(�\߉�Cv]�A�ʐOf�7)�e��/B�����Ap�҉0Ӂ���-�&���Rx�q�ݱ��e�@{�/�����Q=LZ5'�q��s���v��d�t?�0AI���IL����s���;T<���2���,�l���'��4��K�n��w���=�F�m+r3����w���ϸn=�{Π�GhܯMw��f�������� ������K/s?��i��=<, ��ć�����9(?�V~_4�������9]r��<v�T0P̙��SF�2Hp�R�b��"-�+ d��o�-PY�4�=��hߘ�T^�Rw$b��Ӱ�À�H��H,�r���ga9ԑ~��\Eiq���-c�^�S���e�$~sI�� ����l�H��Q��<�]Y9�H�K^��I�Nɳ���6]j��)�~b(h�k��]t;�|�T�z����%�s_����[�C �(Ҹ"��~m�K86� 1�"�J����$ �z�҈�%p,�UM�3P=��N���nk�4 }p��V�U���X�BJ����hi.X<Ǭ�M/�rzX��[ж �,��E��|2���Ot:��ʶt�u��8y��� lj��f��� z�٤���I���D�`��WQ.�������� ̦������*�c\����7Sgr:�/��*!����(\����� �����Fg�oC�{3��m���b�Gg]�|h�����M zi o��F"_eL�r�yb���*��|�>��;������o)2uI�P�mCZ��'a��� 0��_!�Qtp����-�hC��G����r,�,&�$Bi1#ʙ�>�i�eI�k_�j�t�=$�e��ɷA�A ��r�cv�������� �<���gvBN}Y�L�s�<<Slm��#U8�-��*��w��4_���\�_͗`�?O�*��ϱ�X�Ԉ�d�T-{ ����(4Gà�h�W V��؆��8�����"3&�Я�C8�8���q�ʟIv<�U ���?2P8�V���-< c��*�j���v:c�'��x�W!ѻHǡ���X:���o���L����j� ��B���q�Z�^�d�eԔ����C�7�)�����܋q��h�ѣ�d�� ��CYņ��>A�p�ly0�ޥ���A�n�]BGj�u^<��6�2�l3�
Sections
.text Size: 460KB - Virtual size: 460KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 250KB - Virtual size: 249KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 664KB - Virtual size: 664KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
NIX_GLOBAL_UPDATE_1407_A/SENSITIVITY.png.png
-
NIX_GLOBAL_UPDATE_1407_A/imgui.ini
-
NIX_GLOBAL_UPDATE_1407_A/items.ini