�3���Hkf8-a�4pe5��Y�*�\�o3����0������[��!��O��꼫�;P�r�# ��� ��%��c0ӏ��B*"ot��oWi�2���=��;�nT���8��hص-�<T�X�l?����TR�h0a�m��߳�l�^�F�\њ�G�"N�N M�l�D�0���\�~�4=�ͳ��xxr��_z�3]?>/�@G���i�㥁�_D>c#*�&�Q�ܬv�L�S���7l��Q����֬�V&Jf~��s����ZʷG;�Is~�����I��ZR��ƄPﵲ�ۖ\�:���:2�/{xMDZ��GΌ���i�y̑��><���G�YL���D��t.y`���sL�x?���p|2�ӱ��-�J ����?��x1�+b�>�S@�!|!���с �X��Oy������g縇� �` n2��+FY�a�~q���T�#\��®�DAt�.1���(�� *�`�Ư�#�V��sz��/e����6�nR>9��,dZ{C��TcI"�x��4�k�n������0�����TD�����i߷�����������I)q�W�;* �����y�fk��f� :�n�s�h�!�a�h��ՍEf�p���h�y�V$��p=�k���i���(ۺ��M��_ڝ>`���l �`���6<���ѕc���T�� ��|�'k�>��)����*��������2"��`����+��R�Dg����� ~J�N�bd����|ŏ�o͝,k�����_� ���_�ָ$��p�w��i͍��苨�x4Wj���ڇ�5���_ܚie�����I۞���3�Yh'���� ho|���<�Ya����k���!��?��DՉ3�����<����Vd�����3 ���������w$닻Z�a"�iN�+��!螅r�۔]_3w�����~*jw"�O;}���p�](v�^X�ۉ:I�<��Ȇ���dݪhV�3�������F�E���<��=)d�aʭ����VȄV,;�ͨ.Qj ��*��J���N[�~�ϴ��W�X:"|ln��p��\�n��^P�T�]b�ȑS��u;CU��7R��̄q�������������VX�9���z���)S4v:�{�L�O��W�騤�JQ0�W��uN�@�b��5��~���댔\�3`��$��h���T�Q��>q='��y-�~*��s���q�����f���R����4�}�����h���^��&�O�}�7nq��":>@��ɾm����Ս���L��X����Hč����Ya��7��+�E�L!���@5v8`5�M���7g�P���i�=��-v���ϭ�|&:L���*[����`(b���^}�P����� %�&��P;�� ���;�va�2J9�&ɥ)��Y���N�"������d�ʃ����Q����|mL����qj)�i�[Z橃-�Q Hkm���,/���2(�~��EPf�<�:��&���#xt�Dr}$G�n�_��u��eUߍM�1p*�C篓F��6*r6ɻQrՉk� %5���`���j�_)���5��ˢ_ba=�L �����fV*������a�P3١��̀X�|2�[�d��] �m�[���ФF$�nPL�r��W���z��o�Tz�.�T[����}�i�Ɋ��Eo�\�����&a�7qYL�aį?��U0��$�[\�{�79�9���}����ƃь�(&�϶�ܟ\��#�/�u��ƬF�|�,���C�� ���o�-�/�#]-����vK�B4#�|L��:��k��"�5CK2Mp��!o֫�Ц9t��W��(�$b�:�{]�`>����7��|(��7���/z�n�*<�+a0�s���>�k�ƚ��#�Q���[.���{��teg6�&|7����选aѼ�9|pzuǖ�֚7FԜ��O�B^�ƿ�'L4ȩ�jF;�9s�5���W���t��s�8�oe�.锳�o����t@z�fcs!Bm�����f�w��-oʐY���4vX�:k����ۓ������{A2$w�`[��߄�J���Zp5�FOI%h��G7�x�5�쀧���fٮ ����)ײ��s��I�)F��7�)q�s�x!���ړ�u��!9bS�mj��98��q��^��[YͶ^�05��ހ5�o�x��M���g�wc��� ���=U������>ZQ��-�2]<:���z+k��*�*���\��_<.�2@Θͼ��m��Z��P�Q��I��~ǰ��$ۜ�lg2P?? 揄�D]RH]��o4�۹�v�P&A�=֟/�`���{��p<Gi(��.�v H���J���Ó���|$�o��8QaW�L�+���H^e�9z�X�5��S�L�[����;T��`�#8u<�N`(1�b�R�� ��.����������C:z�A\������|<A��l/-����mN*f�������y��`Ĩ��t"�'�l��ՔqK�ybM&�Re6�_���MI|0��^������q��ϭ.�^"�TE`d� ���+d�M���^�[�ه�Q�:J��p����-����o#|��{�c#a�1�/�8+Y��� ַ��ѥ�꯭%!�iY�m�ؓ (n������0���2=�������� O"�QG�35ư��/!1ltB��E(k AⰚ7���8�2"��kJ�i�VA�;��3�|T���- �c2k)��zϭ�u��m/����1���{����$�C k��f笽W�p"�Ԕ ^(�6b%d�T�sB� ��_�(,( 7�j�N�&�}a�8+�ٙ�0 �(1D$1��:�{��ľ!$���4�_>�mb\�L�\�r��|����o�[ �$, �t�0/�(��V�ɉ��J������� �T�����3j�P��*�Cs�T�����O���!٩*7I�yb��+>�ϵ�-�R��P>�9��M�d�?�+���-2��p�j8�������YX����jB���Hΐ}[��嗲Em!x�O9 @�v-ݑ��� �v~��E�H�g6ȡ�L�K����t-���#�+�V�gZ"g:Ϥ�)
Behavioral task
behavioral1
Sample
娱乐社区dnf.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
娱乐社区dnf.exe
Resource
win10v2004-20240704-en
General
-
Target
2beb999170309702baaaf254b6549bf6_JaffaCakes118
-
Size
403KB
-
MD5
2beb999170309702baaaf254b6549bf6
-
SHA1
ae917c5921005bd9a11b3ee6b584f12762edee7d
-
SHA256
4227754545e2dac37233f5922841ca2678f250dc1555963e34a907ceb774c288
-
SHA512
fd9b6971140ffd09a5c6e45715928b55efc6d37ea28bc63af692ef938459eaf1c94f902d2f399047612f8ef2c95bd1edb9409c7d1696a8c047206eac67bd6f44
-
SSDEEP
12288:Pm6MWY+AbbPSPy9XXAEAVy6Aj60B/Q6VcnAS:+SY+0aPydlIyTj60t6AS
Malware Config
Signatures
-
resource yara_rule static1/unpack001/娱乐社区dnf.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/娱乐社区dnf.exe
Files
-
2beb999170309702baaaf254b6549bf6_JaffaCakes118.rar
-
娱乐社区dnf.exe.exe windows:4 windows x86 arch:x86
4831c7abbb16e169eb8ec1d8fd035b76
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord755
msvcrt
__p__fmode
kernel32
GetWindowsDirectoryA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
InflateRect
MessageBoxA
advapi32
RegCloseKey
shell32
ShellExecuteA
gdi32
CreatePen
comctl32
_TrackMouseEvent
Exports
Exports
Sections
.text Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 198KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 189KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 408KB - Virtual size: 408KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ