hFf��p�o����0aH�"���|��%}6ˍ.�%�V|���ڢa���y��� ���O�E�MJ��O��:S��-Mb'�Y^O_�8^8�G��i�\��h�<�*��]��C�ص���"�\P����M����v��ūI�Fc�~���$��+{_�- ���}b��6[+�&85�*���(����Z5j�QE c�M�:}��T߲�*�M���G �TH)�/���yTȩ:�$��)��H~�d�Owg������;ޭ� 0�V�f��ٵ���E��#��w�u��C]4�f�<����&F���=�;UMN�ֈ��^�(9��b?�����Ā��� ��Bv��ݎIlu�z^Ocl�!�������(�Cϣ��ǥ�B^�(����BI_s��rl�2�+0v^_��%-46q�g�X�[��Ù�u/fBczәn�Q��*�]� ՚i{�A�%*��D�MZ��0.��P����u ��p�(��I�f��pb`�q0iJ����}\���2 ���9sy����F�H��L[��t���ei�]U@���� Pp���L�XAEs�khZU���?����.��R�� 00 R̗����4E�^m�D����/ڌ�[�C�hK ��@Dn[�[�$P]��}��Po��%���$���u�a%@�(^����,n�Az���||m����鐈j�cu�v�����Dɴ?<���x�/�+��\�"�9�3&��;���x�����uh��ZW���D��S;��I��)3�F�h�2��t�.y�e���J��Y���w (�lY���z8��V�� a�|���Ɛ�{`���E��}:���f���^��o�����F�fO�Zy��b�7�.�6���Ʀ_��*�������O�R��K�ApO��W�J [sA�?���B ����^o4��8�c2��i��[�d�N�������D]`�#j�Y`Z��m>�q�hs ׇ�ݝ�vܔ��r~jL���z>K���__JJjb�^y�|I�/�c�Mr8F3���r�J�IX���j~�J��t�k���Ѕ�'�@N��z΅M�����@.�%��x6�;^��#4^���J�j<<Da��9x�QL%k��'I�*�$��'hw3=��yc�&T0*��|<~%��e��}E��ܜt��TsM3SzЛtGAWd;%W, ���CT���^�(�9���bq.�]w��A��ie�Phio6����Y���,\�8�ϥ�R���]`/����Xe)Cԫ�����j<=nT�+��M���U��j�����ݭ����P��A�!B��,���3��qN��a���n�p���iA���>��C�`!y���v)"�� )2�@���0%�K���Vr<�e(Y+�b�2�lf�t���/����PMK�8��8����-ɏ8����L��_,0`�ˇ2e'f^@�����O�=���*e����{�u T�&���Z#�l�侇�, �@9!����TL�*=U�F����d+���e<|�����F�9�= "�lX��'!"�K���U��x�vAۏ��O�ihs�W�J!����`=��{��k�v�N=� z�y;��h p�q��&���e#��8� N�lҥ���a�����������ѓ-��7��Ѧ�3��l+�Wn�G*�$8���w����D� # W.��fe�{�c;�c'���G�N�q[�<��E�b�Z<<�Q��mA1���]��kmJY�F��2�����b��) ء�j�[�0?N�rY�%�Uԭk��h��T�v�|�����H�'�kL�d � ��Vup�N}��ZK�4���t���P֩�I��]T�(�]CzG��W�ʖy#^!ތ��#!�v%�_���$M�<;�2�X!f��P�zupD̡ɒ�[JEi8��q�#nU��^��43�7��l3�.�Øx]K�W��°pzd+�� �6dP���}�ߡ���[����ܷ`�����B:-YH����P��So��h;���me�Q�цPE�T�ĭ�%2A�� �{����ؿ��'$���1�����pn���� �U?7:�^?�4�{�a�Su�*y�>�� ZJ�^J2|�����f����3��箟z�/���A�+�`9Y۳��������B�(�ô`�Mc��b�:[G�GPc�Ga����s���o��1j]��5[/��?�@S㮮��&P(�0�w��3<ǝ�.��5s���TN�n�0^����W#���a�!��cm�)��~���\��.�T@Z���^�`��G��;�T�ҳ�Q.B�N,vs߯���ծ�j�(?S��?l�$��?<�"�ѹ� 0��B��x�~{aG�]�*��ݍ���^_�����12��4�g���e�sF�d�# ���좷�d@��.��R�H�vPj-9n2�N�d�/�Q��'�f����X`9`ʤ�p;�a� �G���I`v�tl���٘�+*��� �i���� pS��+Z��q��l�BH��C��#�������0��YYW��G�!��3���Q@�$����z�H���V�zE�����7^�w�9��tŷg|�mf)?)]�o��N���xZ��|0y����>/ R�ū(I$@Q"N�n��i�v�/�3�������WI|b��J�(&�&���1}���9��;w�z'�a�,LA*���ǃ@p��� >��<��!Zۣ+yYl'�V��;~����]G<}�q�紤;�1nWA�r��xe\0�!j��z</������fˉVL�ق�.�D��:�_G�M��/C�"�S��`��K6�K3�Pr@շ1�L�H��2�ڈ��]�ƹ'i�=��t�e���l��`Բ���?磈��NW%��u�ʋz��U��2W�;���O�<,�_�E:`��s<ݡi�ˡ(�L="����E��o9,�=ʩBVȄ���i�s�S��� �#�D�h��.��:������\3�G��tO]�F�u�cu�H�W.O��|� O�zR�K�$ �(�[c���2�!l٨����%����h}
Static task
static1
Behavioral task
behavioral1
Sample
21f449c76f60b58785df04389e2ce812_JaffaCakes118.rar
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
21f449c76f60b58785df04389e2ce812_JaffaCakes118.rar
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Crossfire_VIP_Hack.exe
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
Crossfire_VIP_Hack.exe
Resource
win10v2004-20240611-en
General
-
Target
21f449c76f60b58785df04389e2ce812_JaffaCakes118
-
Size
1.6MB
-
MD5
21f449c76f60b58785df04389e2ce812
-
SHA1
8a25e13fda1ff79cd1b6be22fc68278f9628dda8
-
SHA256
cbdc24b551cbd5f0980427638300ef07386d80f93bc999410360ebe17b30b725
-
SHA512
a0a155623036f2dc839d41c5fac96485b2dfa7706493d8e83c323c31b66694473e239dde541352d991c4281205496e15a707b98919c46903a852a128ca127e56
-
SSDEEP
49152:VEkewU1joTZ2kj1oZAKDoDceDUIWjiJrO9PY:VExjuX1oZVoDPtW2JrOC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Crossfire_VIP_Hack.exe
Files
-
21f449c76f60b58785df04389e2ce812_JaffaCakes118.rar .ps1 polyglot
-
Crossfire_VIP_Hack.exe.exe windows:4 windows x86 arch:x86
8e104c11acde26c7527bc11659e5fade
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
winmm
midiStreamStop
ws2_32
accept
kernel32
GetVersion
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetMenuState
MessageBoxA
gdi32
RoundRect
winspool.drv
OpenPrinterA
comdlg32
ChooseColorA
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
OleInitialize
oleaut32
LoadTypeLi
comctl32
ord17
Exports
Exports
Sections
.text Size: - Virtual size: 497KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 253KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.5948790 Size: - Virtual size: 187KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.5948791 Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
RageHax VIP.txt