i|3\��h�lMقq�Z��Ҥޮ�2�HfFF����?�Ï��j�x������PB�u��8 �k�"Ӛ����c�ԍ`x�T�����̀�ɷ������D����d���n�nU��o��ŏ[�s+��D�W��懆Ȥ�+�!�V=��� ,���p��<�ޅ�'�J<H�E!�_�s5H!'`�LJ��� ��|����s�"wW��]�≭���:X�7��M��&���������4���[����9����9���1�����k./�s�3����*�}r���L�g�{Ơ���*n�L�o(��I��PU*�;�� ��/�(v9���9�d�w4B���j����<ߩf\"b:)#�À�:�J�qgh��F��u,Ǚ�j�b����H��y5d��S��&LGAvPy��z|}��r͚����/�d�6��g���awR<�\�GRrW=b'�ձ�ps^;v��[��Մ�/VՆDQ}��e���A����|^rX�C � 5j�����u��e��Cϒ����*�=9�6���_?���������� :��T-��^�����h��M�5ò����A��d #q�6N��47i�I�m(�R[\�?]��4ez˽�֞L��8��xS���4/G�h��mk�P�"!�+��$ª�O;�W� �)���O*�����B�Fʵ�R�8Ή�U����u�V����� �U9z���)�t�U��s�]����<��k�P�wת�չ�}l<�eKB۪�~��Y�,�Q��4g��p�u�&�����"��`2�ʺ���w��|���V1�5���fQs'a���t]q����͍§2�S��?�a�^��'R��i�c+�p��$�&��I)B�^M\�Un8�|ҿ7�Fߋ��Z��o=���/�>����\vS�1@�U�E������2lj�%�걨��<(�����F��VW��Mz�$`�X�5�ʥ4>?����b��&�@]���@�9(�OHz���-O�[i;�?�����B���zP��.�O�����8Q��Y���)v�0�v�|Dp�*���{R��>\��Q��l��.��2� �K�VE�s%u�Gq� ��@V����d otj3�(lƒp26�`n�����2k�3�� 8�F�W})��-����r�+�\�Yp��!TZ���vI"�jrN=�ŵ�)�������J �֙�gx<qV���9V������� ��ˮ�kJ�@���;�������H/MfM=~���r�.��P,�w!���<'���|��,"���{R��{���h}wC�Y�rB[�,�0!�kWu�5�G Sz/Lp��ϡ��m�1E�j�&Kt��sp�aN��0��J���MAc)?9��X���v�t�E�1�X�2���x�'t����j`��w��z#`]4x{�G��9�h���������.r�U���k��I���|�6 ������UA�;NF�������^)�i�L�+�jc-�s=U�d ���O��|'6�Uu��&��vضJ�����פ����yԊMDK��tz�O(� ^���ȂS���~K9o^�� ����ƓV ���G��.)�����^�9�#���^�&I��8��G�l�����@Fm|�I�R��@Q�3v�X~�kC�.%� >�#U�m��z�4{c\Q�{�r��)'!ɜ��?�8#��x��C�:Y�k!Q�n�C<���q|������n�1�-A�u� 6d5� W���w�������3&v����Ķ��g�0�������ڨH%]��ym�%)@�p�c�W�.d���� �Ό^��ll-lA;���Pa2�cgC,̈�ַ*--�%�����e�(�,m!,��Ĝ�������:Sy���2���s�80k�bI���-ɨo5�6�p�|l+nѹ��,�����wC<�K�����Qe�ƽ�l��vyG6T�?h����[6ѓ�d�����n�cGr����WQ/�������V�����B�r4��K�c��$Ο�q��"���@�p<\i���;�H+p�g3jSm�&�n�� m�F�R��~*$�1��b���v��3�|X����WHC�PN@����V��ɫeϭ�� O%#u��q|r�G���O63�Fb����п�����Y-U:��)�9�������W�p-u�U�0ɿ=����K�Q焋/@,R�i�͂_����g�(����9�_o�� l����M%p�b38�e�[��(��by�����i+�ŪV�zb.]ջKtA�U����� h4�������:G�l�f��H6 c&�(�;��E�3�$��j����G<m�� cxR7J�|��� 3>��lju0�4��iKh�J~���x�ط�9P���3�9�$Y��� ��S]G��u߆��a8�n�B9�旈�"me�uJ�Y]�o��$��B�R��ùr��>�胦 �������SrnO����#91���5��n�s|ؽ��d�nqWe}*n���{V��Z�k6a��"l�s6�g�9γ.�pw���'d�'��e�l�`4z|iU�_+� 3�$Tz#����+�.�}q���1+�j�����ٹQ�QG�l� s��xz)����|)�S������-H�jJ�b�Wʂ=9�A��b���a�EXF�q��!/�}��kKxӯ���Yp��1��K���QqУ�h��.� �'r�Hn���rk+��]i:Y9=H�6�:ɦ����L�QD�n^�C�Lچ8��c����o�Ndz�i�_B8�]�QL���6�v�� �RQ����S � �UKm���v�I/��X�h�u~%�������,�ԡ�Ż�0FI��=�%/ߡ�� ~�S`U)��c0��{-�ЕL�}�-�Q?^�N���*~D[�� �l�.UgX��倛����Hr�s,IcǠ�� H'm�?$@�8=�H�&H�3����N8-! L�mA�7�c{{N�3��<�A���"���� �P{��mK#p��� ��l�3�\O/�D�2g� �ż�Hp�����S5lH�ֺ��Eւ��8��-��j$�1HD��2�y�
Behavioral task
behavioral1
Sample
VNGMODZ_Free/VNGMODZ Free.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
VNGMODZ_Free/VNGMODZ Free.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
VNGMODZ_Free/WideWall.dll
Resource
win7-20240708-en
General
-
Target
6a37ded77ea5bceef28545d1e0ebc9c0_JaffaCakes118
-
Size
444KB
-
MD5
6a37ded77ea5bceef28545d1e0ebc9c0
-
SHA1
a09d81bf73a44be8503c7a9b5551338d70cf3f20
-
SHA256
b71de496372c982d4ad831b7214a1a0108a056827986ff068592d4f1b57b7fd3
-
SHA512
736388e2a3e0a57aca929ea3bc1bcfb404279c31de7b240fa762248231e47c5f085f7321b54f680e4feb552ec8ee9a6e37fea7d2916ce5d0f146a192ee7b6b5c
-
SSDEEP
12288:E4tD3hZDFx8eSBall+5g7rdeFbFnn/SJKxvh6KI:E4tD3bDQvm+m3dWF0KFm
Malware Config
Signatures
-
resource yara_rule static1/unpack001/VNGMODZ_Free/VNGMODZ Free.exe vmprotect static1/unpack001/VNGMODZ_Free/WideWall.dll vmprotect -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/VNGMODZ_Free/VNGMODZ Free.exe unpack001/VNGMODZ_Free/WideWall.dll
Files
-
6a37ded77ea5bceef28545d1e0ebc9c0_JaffaCakes118.rar
-
VNGMODZ_Free/VNGMODZ Free.exe.exe windows:4 windows x86 arch:x86
c0aa905a944d9ab1c83721ad3e7d8771
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarLateMemCallLd
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 164KB - Virtual size: 163KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
VNGMODZ_Free/WideWall.dll.dll windows:4 windows x86 arch:x86
a819932786ce05e791caf7800ee5c964
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LocalFree
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
MessageBoxA
gdi32
SetTextAlign
advapi32
GetUserNameA
wininet
InternetOpenA
Exports
Exports
N�q c�%!��V���\���1]��v ����4�!�N�-|#���T��&p��q 6�>�On�Oh��� Q��4 u0����w��c]���%���.ټ=K�9����o��t�B��s��^�Y`�� �|�b��c�*ڳ��b�aQ���g�G��W��Mm���є�V֦�� j�ʵ�V�n�C�O �������e��)<½Qĺ�b$�x.�xg�~���3�t�!�ـz�{��5>m�!�����������؊���,�2�85���%����w��wCT������AQ��il��݆�imө��Xk�T���������J��Xggn`�6:/=�v�\�t��?4b�����^';p# I�&�A��~/���mtÓ�d"��#9Ԧ� �w)R1��E��1�g��}�0��߈���>������h�={����f\uW�{�q?�Q���Y��8)�Q��U�N��z�=�s�me+�!Ι�@dVp$ ϗVP'�]9����oɀ!4�x9�S��L�ԎT ��2zO}��`�j����;�դJ)9���kW��ȡ��'3�m�i��������$I1���SMw}U���Q��-�,� ȷ�^d<>ϗl]���6E�A�hG[��,������V����ej��У6إ�7�|�����80x9�^���t����۶�P�d��Q�+�ˍ[�^��1��|eX4��x����0V?��������Y��8<�rF��7{|!|����@�wy���� hM����9����FCR9�/��L��#ݙ�Z5��7��RR�2����rbh~�)�� �aqn����,\�YdS \�S�e�)'7o�ndU`�<��p�w�`�`H�c#�T�]��8��#�l��MN��K`e�3�b��[�Bfmk(?�,�����Ȇ�^�:)�RI��Hi.�g��\3�+^{Q����֘n�Y�����8�f� ��d��� M��x�#�l�p����pX�ò�߲�;4�S��C��''#����ҭ]f�1�#.b�#%���q#;ćÎ�\� x#LBG��ՋTq�x��L�E���e�`��0b�g\��x�QZolA��@���Ơ��S���_,u_>Vf�R��5Hxn�A#�^�;Hn6����-���l�1 M� `̬���1V7�+�<t#�=�k�*��i�_���Ӧ%�^�DW�� ���5R�TM�_�.�p�)��V��j"�����K�����oLdb@��q�f�'=E(B�^� I-w�R�A*'��q��>��h̄�?��N18���/�Y�N�W��U�x�˗��T��g=�f8��s����?uq4�K�ݬu��ۘZ>%d#.��Ѓ�g[;�����,�L�,'��x-pW�]���7����JY�7�g��⌜���CG������}�^�Ǽ�m�W�gb�Ot�ա�aC.��C���+ ��JJ#)��v��i/0����P���D?Je�]�䚾��5fTU,�)�N��'s| ߚ� ���֫~�X;P��� }q.��pCJ!aȿ��J�>�A���'ҴElQ'���|�~DMP�pW'�����b���˺�ϓ�<^t���l�µC��`�gE���E0[��o�4ٳ�-�� ��w@�!d��윐���E��/P���oKŕ��t�Fh��G���ыԪ��%(���� 6Eksh�8��C�(�����Yc�����F�����A=�L� ,�᳓��E.�����D��`�.�m��zq�k�|��ۜ� 5����*�"���v�I�;�S6�R� ��}��G���m����[Ҭ%N�C��}�;M�<n:�+11]�d�G�6���k�;�ƾdH�8�o���=�� o$��s���=:��?��n4s��-8�<��=���� �S)���EGV%2��JO�܂�9�d08�u��ٞ�f��c����Y��S��FRîiT�����a�HҲ�f�m���1�k."�,�?}8b���?ӺE���z �,Q��- ���;-Y�>[�7�^������@|e��*��6b*$w�Aޅ*�`��r<�����S~)��M`}����T����ӑ)Ya8���3O{���J��a�m�RQ��^�*�B�m}L��L݅����yS>lQ������a������n��Ͽ��er:fZbJ�^�7�"��T�Z��$����\�v�q�a�iL{�����Q�oc+Π��Z)���>��!���,%���b������6=�����-�*��y$�7l;�,�G�zIv��wm���kot3(B}���7$�����[i��)��-U��b��0�}l�3�Z�D=-*_������é���hp��V�2�����x�\�m��d?C��ͺ1����R�5Q#����ь�3R۠�������+%]�4*)�g�목ց}���9�h:��Ei+Š��P/t~���Y�� >Ϟ��L*cȾ�h���GՇqaɴ�'0Y��f�ͩF\��g����Ȗ(.m�곛_71Տ�S����O.`A� f, u��@fP�#����F���1#�L�3�f�p�>/�o�!�G���<���=Ǜ�c:\hwP>��A��"@/�ly .s ���v<��~i�̫u;��eH�E���I��K� 8���ݦ��Ӎ]��|}��$�'ۓ\�p��R"RʻG(ғ)��L{�8���?z�:} e���T���P1��]y�� �����@t'�B"l�b~���[��O ���$��Y�UK.��Iw��xt���q�&%�w^ ��\KX�k�krٲ=M�X��p�,I'xQ�I�kf����S\-�Eu_��0���8�ja�\�0 +�2� �����Q�A�lj=J�N�A\ ! ��jius���ƹ�îհr�^��x>__�M���2zXO�"ߍ�ֺIG�{m28,��$�0��N��)2�Jep��YZ�^�w^��2@ub�d[LFxE��t��J��"ؚ�tl��~�n�����Q�mc���=3o�Dғ!�M�m,����|v�(W0d������+oDg1�/(%N6�Y���j\�'��|��l�b~�
Sections
.text Size: - Virtual size: 77KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.shared Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 280KB - Virtual size: 276KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ