��/`�zC��;H��5ʛ��Br���x��C���-� ލ��5I�� V-^�G�t��u5�6�w����@�Ե0�s��������Ә����&�wL��9Me�өb/�Ix.�&F�{�j� @O dp��� ���o��F��b����sI�W�{9��Zܑ�;Pg"�u���5�������8����dN���� b�"��<l���埓�<�Z�?�+ʂk���o�c�S>1�q�͟_���38�Sn1iK|h�E��S+�p%��Cw��Gl���跆���k�ң}߾�9��#D[;!��������4�5���P� ��x����2�6�~Y���d�lj�S����W�E�[=��!O�����?Ih�� 6YUO���K�^ԭX��F�0 E�e�Q��}���r1e��E��ީg�D�Q�<x�����X��y�&�Q�8��6M�wfq2K�g[��z!��!�nL|��4��F��k����w�֠#I8JNTxЪs�g�ݓ���t[��5�'�{��������c<�G�{��u��^�5���� �zg���dI��IZC����~��ρ6B�^Q��T8X�:7JJ�N���q�5��������p�����|r��i�d�4�x7a�%�f��6�ЪI����ٳ��^�$'��}~��B����J�bx�VcDb�'��g7������x_��ظ���_��$l����V4�!�����5Nd���VH N"�'����Pw��t=Uv!j �J�px�+!��: ����H�-@<�.��u�{3�U9a�Q��uȻ���U��~����֠���OFgc�4�H�p�:�7��E7]��ew(JG��G#h��DwD< ڊ���G��������cz��=ž�Md�]�yzz$ְn���n�������DR����d��i}���Hq�EMԚA�~l{Wu��e��փu�_�PCE|�F�e(�� ��p�������W �ݫI�w�����>+6�"��7��p�c�Cv�ByϹFuI=��}c�gϜn �l]���F}-I˟LF9^��tz��<�pƚ9�hn�����6��,�j͜��6En<��m�c����H^м]�Lo��Ϝ}}#R�Mx�/���%]s�K�%}� �h��v?E�c�����h�琉�F�}�Ӆt>[���Q�{� p���+�1COɚ\���G�y��AO7dն�9��$�ќ���Y����%!��� ��p�Z�����2>"�&�v�r�8�2ֺr!g���� M�m�+�T���$��٣ٿ�P���(Y�8,ŵ�Գ�^�˂�Ni�L?˙����.�@�ub �Ew\�/4J�����@��꾥㸖��!���\��7�yf�s�}����A3�� �-�r�����)��7����[� q�J,n�����5��ݛ�HA`��K�@V��q8�:t�� !���J��M����-��RK���Q�$�� �M�=˻ê�hF���C&�\�}iv��ߝ�g����=0(�:�.Bo��0yDF*$7�S�UL�E�p�N���6�Q8��� �4�j� �|JζB"C��� �8�N`��G~Gx�E�����0�DJ��zN67:�����*@=�d�멗��1���V�h�����m�E�ٸQu�D�l����5H�|��i�s��T�~����!����@� �����˿�Z�F4���5�f�Y�#|���� �¿�@v��'�����=���?��CCҡOɣn�ƅ����,��Ͱv����5�9? �kM*���wMi'�6����܋�M��KȦ�ǜ/B��S'�U��.�\F�I�1.�!|�h�}U���0���&�8�u��������>T_���H���n�+9?�g@6"k�<��:���]����g��S �|�(cK$+f������'�%$B�D=��<���5�߬0bX�^��j{0s:���%W�v+�8�+�qg�%{�����͢�?��T���/D�E��R�Y��Q����8Y\�I�G7� �l��O��}Fx�M�bg�MX:[�i�xcH����Q0O��'� ���T��&ES�NzVZ����>YE?�~.6GA�Z����a�339��Ѯ��٢M�u�O�M�+�{���6|�3�y�,��$\����E�x�vq��˴��^f��}և ɁbB���bV=&gXhF6Y�_�5�·��j~���K�e@��! Dx/C�G���lu� ���cg��cM'dA��z� �p_�yR[��2�Q�r��]��├�k�M�*+�l�ȴ�̮����I4����s|Y��8�pP�-8����@�M��6��F���r[���3�������ݠ�D(Ċ���2]� ����_Cf��q�*�y�͠^���Xu ��5@�N���6'�7�� U���TO{0��i�ۙ�~�������4�$�%�i7�Lp6�7g�x-��wE�j�A]Si����l!X��=M���tD�*��SH���x�b{Z��=�e܆��s�Fz�[�����!�LQ��@� _��� �m�����;�����)ū?����}�Z�[@�v�*i)���^)r���i���uL��wX�$MWqܘ��2��k�<��/��Z�ծ����ut)�y���H�Z�-c��q1,�p����{4*�4���b�u�mi����ך��Cq�2Oi�v��e.�k������H%b{1�r�����o9�z4�C�6�q��`��ư�ki�����2q�>��x������[���B�h��S]� `�ݻ�u��2�d6���T-���[�ZrI�^���1��ɪu�8Q,�o4�WD���m51�@����e�`���I!ĕZ,+��bMu���ͣ��U���©��𬨽�#l�� 8K�lt �s����h�~,Zk���O� ���OPT�,*�W*$�œk�)"y����.�8��RpNq~bO���"@(A�D[$UPc�t#/����GC��KW��������r�9|�����1��L�@K5��Kr&?� m�A
Behavioral task
behavioral1
Sample
155绿色软件站.url
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
155绿色软件站.url
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
RobotBox.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
RobotBox.exe
Resource
win10v2004-20240709-en
General
-
Target
4128e9122440d3aa964b0eed7c6bd76a_JaffaCakes118
-
Size
1.4MB
-
MD5
4128e9122440d3aa964b0eed7c6bd76a
-
SHA1
92c67b4bad34422be8a2b37a96180a76890a3406
-
SHA256
2c1975199fa849b9e8679576e1a61f722f6d4a885ca3b36feb6c603f78d9b2a2
-
SHA512
b4916a2ba3572cf06319815aac46043bba8f3c7af4371a10eb0a04b6720275fa40cc72c84a40864d65e13e2d15fbfd7f66c446f53c3b932c29049d7a9759d3de
-
SSDEEP
24576:u9wfx7ZsFm53+7CemQs93klSgw/DIK9OGB1FokXGjtJ7lKjViAs3rfagYgYmX6q:uyfx7kmx+mQs93kl4/DIK9B/okXIJ7U6
Malware Config
Signatures
-
resource yara_rule static1/unpack001/RobotBox.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/RobotBox.exe
Files
-
4128e9122440d3aa964b0eed7c6bd76a_JaffaCakes118.rar
-
155绿色软件站.url.url
-
RobotBox.exe.exe windows:4 windows x86 arch:x86
f5e921a20385d865f4bc0a7dc434d6f1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord4080
msvcrt
fseek
kernel32
TerminateThread
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetCapture
gdi32
CreateDIBSection
advapi32
RegQueryValueExA
shell32
ShellExecuteExA
comctl32
ImageList_ReplaceIcon
ole32
CoInitialize
olepro32
ord251
ws2_32
WSACleanup
msvcp60
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
Exports
Exports
Sections
.text Size: - Virtual size: 287KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 29.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 540KB - Virtual size: 630KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1008KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE