Ҳ��$>/F��5��sBSg�|�M�zk� O�q�3� ]��[�����M��!�]����rwn� /�%�����B߶~�ζR�3D��\�f�F��IѦл�cu������|t���3/Ffmd`:(���TLΗ꼥ˁ�t���5�J��� 7�SA�B�XYh���"܀S��g�P;/nw��v ]Mƃ�e{��EE `|�RZ�@Ə����3- ����j�)��P�ݠ3=�� ��1��q�<�`x���5NP���l(��V�f�M<<�g� �*U�U;��%nC���Ȓ(c'�~�ViKn=���i=�G����:ۮ#�&�"o��o+��wU�GT[U*W0^l�9#$�E+f�G��{������Ğ��4^��3 O���=cp��A -o ��|ݿ��k�~ ]VH��*,.���:[���u�o֎��C����Ȉ,�(��"�����V��/ϋ&-&��qi�(�~��s����]�r>eQ��o�-0���Z�l�M��!&V�|��7`r����yl���MIU'� ��shNӸ ��k�����8ƅ|�M['���e����R�u00���+`��ص$�P�"�杶#���SX��켂2v�L3����/M���[/[VѪN��9}�ƂbԢ�L�u^��ɍ�L�������vH��RA���(���5�p�I���Zjk���\�\F^H��Z/qv���6�cH�1�$�'���D�<��ۋWqʬ��5�R�D��n��/�ܴ����һ�~W�i�b2�L�K�qѥl �Z��=6^��hZt�e��fD�ԣ�����N��~\���U� �1ӟ��44\��v^�)�CW��Kq?Ȉ�]~-5��T�K��:�ƫ�����ֈ7���/�! �hz�m}���U����D@��x�P�?sc�[Y ��>ל6X�K����V�m_?q@١�W���XM-�)� K���GB�hȋ��o�K�Лik}��]���&2��Ui�a��n�#T��6�S��O��o�o ���u��+��V�m�R�������f4���س$hS���♴i8M|�� D^�s}�xX�8̨�Eſ�٤ -Y��L�ǂ����r��ɮ8��ſOo�k>�ӲL��Xɽ��/}4/��ݹ'��[(�o��Y�������Le�o��k�3�!OP�M���Ϳ�����v�h{�25���Z\�v�2b$�?2ɏ���4Ƈ����m0�9ANq���0���>�M=���[�d�7yu��S�����eu�T!�K�C?'���9���n�H�]��0[LW���@ �<Ÿ�]$���ި��h����1�����+8�{���>�@��^�w!�@��枢0���B�_x}����%ȕ.0.���y����A����j���ʼ%J������,#7vU��{�v��d��v0?{ACsZ��k����=����͟��3$�-���p� [���1X<�I]��E��Af �!��!����Hؒ$���ﴞJ������!�����l���S�Q7Mx��Rw������¬/����T���~���:�6��N ��t �=EE�Q=j�xh��c�nE����_�v�;�5d -�F��!�κP�:����@t��(R:V�w��DE�*����_]<܇L�P���>����܄R#�-2� �&�0�Y���+x(|��s��Ŗ8� �^���<�&���kYq����� ��ɠ�,eg�5Tpq�V]����D?���9N�GCk����H��6�>V�礍zboZ��+�3۫#}����'��?J �f9��$Xb3�&�|I3a0���O:L�2b��Ah��WF����z|�O[�I���+W����SK�5������a:U���8��^�P��Lq�F.\���K�Ku�64�-��{b��|�h#�M��}���0��+ ;[5p�2�a |3;�^�#�*��+�}���T���v&��cͰ��yx�G�(��^B ��_���.V{��F-����pUܞ� �@�xS �\��n�"�sYvͨn�73p�Xb�=��8`~:�����Z3!�7������7VX�i�;'m�*��^x/0Ts7��䧆+-w����a�69�h��֪/�r誒����""�����6ƁAh��(��!��[O���|�+����RQ��R;��[#U݄>��+��6�.n9��yC���W'wͣE��|�%Im8���9�C��5��AbS��s��[|���U��c��� ��S�PZV� _�FV#�;u���I��,���V������y�}%���{�;��ȍ+�1����'"��B (~��'q�9�G�j��J�V5Z%Z��� ��G������� )H��9�������"��c�-��� ُ\/�$����ܩ㼶<��#lv�'�["V�H��'�@,�O^`�)S�)�����2��u�7*�K+^c�Rw�g��q"j7�*�PO���r��X��]��YAȞ���������������EŎܣit ��|F^��`d̺B1!�r��)�к�.$GӍ*r �8|h��g{��&�l��N qZ)�VS�]`e7�/Μ}W��Q�4����>�?�E 8�M�/�{��'O�S]HB��c��Ėt��5�!���rB����<���zIgi�"H��~�%m��-Y��;�4/����m&Y@��"M��}?^������,+@������.�cM�/�?g�h�qe�Ŭ�wVS] e|��\��\��k�d����������;�'p5�&�g�څ�>�� �ړ�&s1AZ5�pk ��r���Y��&g̪)�vl�@)e$��4��9�ij�Z�"YFc{�0�E,�0��ɣ���{o��TE�P��1j4²�N���,٫�Z��q�v�/w*dqC9+i�����K�e�+�̲bf��a1�Le��8.G�Q�Ea� ���Q�%�]� ����]IF�ϒ�*���[����S����z� T�IVO�0���� \E~N�S�;�����s���`!&��D��(n{&�A�"�P��L[��Ӧ'*�Q�9������C(�(
Behavioral task
behavioral1
Sample
Activation_Tool.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Activation_Tool.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Start_Game_Launcher.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
Start_Game_Launcher.exe
Resource
win10v2004-20240426-en
General
-
Target
7a1bf44dd1238e12b0e4e3aac44da8ab_JaffaCakes118
-
Size
8.7MB
-
MD5
7a1bf44dd1238e12b0e4e3aac44da8ab
-
SHA1
e259b90f6f19570baf729119669cf1c55b7a9bb0
-
SHA256
acb73e9147c57b9c10f978ef440d67bacdf203df4c4aceef8160294144ea1093
-
SHA512
b53d6206f6035f8dfd1eb52583c5aeebdeeb67abe336230678ad561018a97e7872cfe52674107cae0771035dd760895b550070ac986fabe795ab603dc65586b3
-
SSDEEP
196608:aZHbd5GQSr98gCCGNu0EHGF2xpLdnDQyR+Qt2Ih:afkQW8VC0EHGF2xpLlcbQka
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Activation_Tool.exe vmprotect -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Activation_Tool.exe unpack001/Start_Game_Launcher.exe
Files
-
7a1bf44dd1238e12b0e4e3aac44da8ab_JaffaCakes118.zip
-
Activation_Tool.exe.exe windows:5 windows x64 arch:x64
d29a30c456ef12401e6034c616d6753b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
wsock32
WSACleanup
version
GetFileVersionInfoW
winmm
timeGetTime
comctl32
ImageList_ReplaceIcon
mpr
WNetUseConnectionW
wininet
InternetQueryDataAvailable
psapi
GetProcessMemoryInfo
iphlpapi
IcmpCreateFile
userenv
DestroyEnvironmentBlock
uxtheme
IsThemeActive
kernel32
GetVersionExW
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
RegisterHotKey
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
StrokePath
comdlg32
GetOpenFileNameW
advapi32
GetAce
shell32
DragQueryPoint
ole32
CoTaskMemAlloc
oleaut32
UnRegisterTypeLi
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 672KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 198KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 8.6MB - Virtual size: 8.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 175KB - Virtual size: 175KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Start_Game_Launcher.exe.exe windows:4 windows x64 arch:x64
76b1fc54f02cc0e3a6e49254fe03fcfe
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
kernel32
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateSemaphoreA
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFileA
DuplicateHandle
EnterCriticalSection
FindResourceW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetStartupInfoA
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
LoadResource
LockResource
MultiByteToWideChar
OutputDebugStringA
Process32FirstW
Process32NextW
QueryPerformanceCounter
RaiseException
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetEvent
SetFileAttributesA
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
SizeofResource
Sleep
SuspendThread
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
lstrcmpW
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__doserrno
__getmainargs
__initenv
__iob_func
__lconv_init
__pioinfo
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthreadex
_cexit
_chsize
_close
_endthreadex
_errno
_fdopen
_filelengthi64
_fileno
_fileno
_fmode
_fstat64
_initterm
_localtime64
_lseeki64
_onexit
_open
_read
_setjmp
_strdup
_strnicmp
_time64
_ultoa
_write
_write
abort
calloc
exit
fclose
fflush
fgetpos
fopen
fprintf
fputc
fputs
fread
free
fsetpos
fwrite
getc
getenv
getwc
isspace
iswctype
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
printf
putc
putwc
realloc
setlocale
setvbuf
signal
sprintf
strcmp
strcoll
strerror
strftime
strlen
strncmp
strtoul
strxfrm
towlower
towupper
ungetc
ungetwc
vfprintf
wcscoll
wcsftime
wcslen
wcsxfrm
shell32
ShellExecuteA
Sections
.text Size: 706KB - Virtual size: 705KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 61KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 5KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 215KB - Virtual size: 214KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE