p��^;"�"� ���bO".-έS�sQ$a�fز�Z[�i=�2���4tT6�v �����F��Vwj9X�w�}DS��ѹ3��p��6�cY����MO���V�b6����3���߇+u'��r����{��9$�����Lh��LZ��U4��@t��d��%hV,#��.��9^X'�x���8� ��� uNJ��������370�C����8Y�M�1r��b5c&:��z��]��٩s*��y��X�/���M���x�Q2�~��K�����ɀ�R����#�i�EƟ�r�: X|tf���Gs�{φx�Uv�;��3����O㖅���CT�d���߆���qh(�j�"њ��d7t��������53}�2Ɽ�����!:6�����y�rr��=B�]�r�O���E�)+G!I頌x��O-k_��o���9�,��'k�)�)��+���#�0��� B�'�;ŷG~T�J�s�1�*v����\2 l�(����.���v��H���8GGRS�Z�η�s���m9GY�!8g��qoV|�|:�@E E�h�H��s��sO8� I���-�Y:,�/$�������lU�>��+���*�9�V��,�x\!B�������V^����Ϧ�+��2�ç")n��[�a4ǐ� �^�f�Z=��E�Ia�]��h�([��+Gk�*�>�a;��H�%n�)��]K��GF��UBp�V�F���2-�ĭo��W �h�0�h������h����ү�����b&��E�=� |��j�ų�+��Ծ�$��J6O_>\�:qL��,QS��Źۭ�:�(7�0��2�%���/�����RA���^?�z���0A�y���P���t@� _��Đ���;pbx���>�����pdN9њ�; ƪ���N��9��g�h`��#���U��߇�1y;("5�so+t[��k,�-���� ~ ~��I\�������ċ���y�.�� q�T=��Z���֥L�α�Ѯ�J/,��\m?u�KܜSe쿞u�0��lt)ի� |�� ��<g�]�h��ώp�۫X����� :w��-2���3��o�qAoUߥ*��U�0�CFYH�����R0���[�,� q2p��_@��R}�k�=o}#6Z��6�=�9���c8M�eE�G��[�*E��2�,QFsq��LKZG�[��?_�R��c�d.0W�㞰&�Ps�Ș�9N@;��,Dd.Jl~�V�,M�KȈ������tNt~}E�y��K�?���O���c7���q<�Ȁy�ev�͔x!G����w@�[���I�ji�S���^��6A�����n��̸"�S��E¡�$?��.?oD��K �����?��'��l���J�<�~q�|1B���r�6|^�0±:�Q�rߓ{���JN�q�vZ8-��N��m^,/�s�:������~��g$>��CX���U�=Ԛ+#-�{K鵊�0*�J����9��u4�`K��i��z�?zc��Ӌ&Zt�|��)m�#�Z�KTs �����C]�-�c��)ʬtn����:��x� ���#��x��2�֊X�ru!���S��N^��{<��'&�'>ȫ?M���d�yx����I��Ɉa�=vY��L�[4����Mw���^�zw9�����c'W<����!�dW��R{E�!������KLB�z.��} @7+��ݳ&%���7��VX;�7�R�=��y7k�TK���a��D&-аU��� x/�ڮ��V�����N��ȝ�i�0���e]�����_�kt� �;�T��fG�t��r2�����U�[f��]?3U�\�\�=��Zə�����T<�]�����$o��9�N��"^�rg�� =�~��w$�f��]���q�cA��a�XR��jr���E�zB�fƜ�S0�D/;ޥI�A|j��+v�w���1�U�~S����˱ �j�ˢZ2F�څ5�Y���L`��*�[3�FS=�_��뙇��m�f��EѮ��8q�b��F�,�u��A(d�G������o7A49=,l� �c�� �tN��}�QUOna��݆/��m�͞���U�/hb-�\�t?ę?��w�Τ� �⻥* �,y�cS���b��o�I��r$�r^>�L?�:�ƯI.�.\��2�U�`�i��z�2�lBl�<�p��S7����p��� V? ���-R�6�`?"�ν�Ėɮ�IM.`v��hcòfϣ�6 �l"U�!�J] ���+$��f��-���%I�"�"f�U��"����c������ l�Cp4�Q3��R��`�����ђv����t>�(�jf��A ����V�ѹW��N�徜D�W�h������(O�l��K�v����S�BT���#Ȩ�)��z�)��,=Avz��~�eT�)"��q��)/��k���j�>�"ө�8��Ŧ<$��6��ދ��d�4:��M�t �M;�ܛ��^O�UT7lT��gD�YZ���̕ȷ �h�&�Y=��F'�oǧ��Iq%���(�+.�;�-�CfӲ}G,����t>�4���Lu��3�� LH .��vbi���N��y�~�j~|2^W��m�,��U'�XtG�5� Y/����Se�ޞ��M���s��b�B1��/������L��TӬj�0���A-��PkJ'��&`e�ܩ�ϛ/��V!�i���W���çm�$�}�V���HW�w�2��h{��S�l��Q�����b��N��-��bƈ��#m}:�^ٞ�^bŬ�`�@�}8�/_aLL�s��^�(c鍜��?��1�����~���P�Ak�I��j@?;$b�>��)�͐�y��"�1��-:v.>��C ⭩1�)e�������"v���e/���0�S���%�WU��lj�+7����!�V'�U([Rp���?�Y�d�P�6C(uph�����׀�q��jL9�|���|�-��'B��I���CZ73��j\��֛�T���������m}{H�(��$��e�8�p�����4�����q�ľ���G�V]T�=�#��NA6JP�u��+Oq�Lp'G
Behavioral task
behavioral1
Sample
DNF洋洋V1.19/DNF洋洋.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
DNF洋洋V1.19/DNF洋洋.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
DNF洋洋V1.19/spacewp.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
DNF洋洋V1.19/spacewp.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
DNF洋洋V1.19/洋洋本地页面.html
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
DNF洋洋V1.19/洋洋本地页面.html
Resource
win10v2004-20240704-en
General
-
Target
763cedad418f2e33a638617323f090cc_JaffaCakes118
-
Size
1.2MB
-
MD5
763cedad418f2e33a638617323f090cc
-
SHA1
8f1f546d4e95beb00f8995215363cb0e6526e2b9
-
SHA256
16fbbb8ca87800dc66c15f5f07df86d524627ed4464a4fdf06683f0e34349794
-
SHA512
cc5b475ec1ae08bcfe89b2f2219b67ca789d5782c22fc43a14dae0915163f981cd7f6b2101ae1b18b68041cbd3da22cb2937b13388df07d03a47090226073700
-
SSDEEP
24576:e+4t+5wuQOwbCxxo/SxALWRGsJWKChBFACX12+IOOaNAtf68cPk7VeqKEQY:N95R9wiW6gQGsJ9ChBFeOOOof6OPKEQY
Malware Config
Signatures
-
resource yara_rule static1/unpack001/DNF洋洋V1.19/DNF洋洋.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/DNF洋洋V1.19/DNF洋洋.exe unpack001/DNF洋洋V1.19/spacewp.dll
Files
-
763cedad418f2e33a638617323f090cc_JaffaCakes118.rar
-
DNF洋洋V1.19/DNF洋洋.exe.exe .ps1 windows:5 windows x86 arch:x86 polyglot
70c9daf8a70a2ea83f9f2c2c68cd993b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetConsoleCtrlHandler
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
BeginPaint
MessageBoxA
gdi32
SetTextColor
advapi32
AdjustTokenPrivileges
comctl32
InitCommonControlsEx
Exports
Exports
Sections
.text Size: - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 348KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: - Virtual size: 288KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 308B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
DNF洋洋V1.19/spacewp.dll.dll windows:4 windows x86 arch:x86
efcf11c2d85aafa4611a1b4a0e024f8b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalFree
GlobalAlloc
MultiByteToWideChar
DisableThreadLibraryCalls
user32
GetWindowLongA
SetWindowLongA
GetClientRect
ole32
OleUninitialize
OleSetContainedObject
OleInitialize
OleCreate
oleaut32
SafeArrayAccessData
SafeArrayCreate
SysAllocString
VariantInit
VariantClear
SafeArrayDestroy
Exports
Exports
DisplayHTMLPage
DisplayHTMLStr
EmbedBrowserObject
UnEmbedBrowserObject
Sections
.text Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 50B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 278B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
DNF洋洋V1.19/洋洋使用说明.txt
-
DNF洋洋V1.19/洋洋本地页面.html