���r!��\���}dlZg�.���Cĸ�3��yҬ�J*�_�)F��6#qqe2ށ& T$����`b���Z�P�(i��+�I7Ru��sO�P � ��B�9|~�,��1X�5���7��;/I3����T��=�� J����:�R��#r�:����gd6&�*���c��/���K���z�߄�I4e�/T#�>�:{��;/")/�lӬ� d\��C���o~N���*��Ikx�_��\� �m�� g_�v�� L�Ԗ�����تv�`�6_fv�� ���2r��xaˑlj��� S��\��}˨��}���{�����ƶ��-�CM��&�9AR{)6���MCB�&���R�&I���݀&ف�@�:-~]���a=M��!����۹Pz�C����+[�У1�e`�6�]�M]�m�÷�Z��f��!��R���ӌ��WL�K .��Z�B@�q���ݨ ^˥��^��,�Y��W2E,"B&Yējե�{��^긨�FAo�+�l���\5��n�huj�'S/W$�(��9����Ƒ��F���A�|x��PhC)ow����o܂�(�u�R�(W�����%:��#FV���.\8[�=���5���D]�t-7绑ͬ��'��{[o�>r9.� !�����Q�Z�W�9lp��5h'f��qs�ʪ��� 7�"9;����X A@���7�P��G�t2'��@x�=����;SE�2KI�|!�q��&ˋ<�tXt})���P��4�μy��-��K ��lݻ0�a��Fraw*[>���M��(e2k"�?���j}�Y�9T�����2F��ڥ�|�R����-�7�Ёh�v&��l�z_;�a�2+$'Cm���<�@���/_ڤ�7}ܻ �C��0����c������H���9Ú�� <%� ���l1me�r���'ǽ�j�/O ��k���Q�_I@d����9^�`�]���c�������}�z^�w����6����� �W����kt?n�`��9���IQ���!����D�����s�����Ӽ�N�k.M��������x���è��!�b��˟l�3�%��;���,�<t��3{Xg|� Dv��^֚�7o���k ū1횶��\c��qQ��>�T�o�Z�>���Rg��$y��ZI��?�G��~��2��5�Y�w���h[F��a��}g������%f[�o3�R��Wk��J~8�`��6��%��� �{�����ί�%B����-:�3h�i"s��A;�Z���i���:���tK�I�y����7������D��%������˸�5�Rc�Nx&tW�Y^�`w�8F�L�,:[ �ϡ ��u��a5{!�,oŞ���)��VYCZ�:%\�9Q��-� ���Ad+TF[�OE�s�ycEA�`���&7+�Kw�!�><æ{�����UJ��H*���d�-&��A���.�F :Fdր4s�'��LuHA#�aY|��`4���Ǵb5��Gf�H��ό��kJ��^�����2φ�]��63#���Ӈ�&6<�GA0��0+?�'ڞ8�سwq�;��[�����^Ęh:�Ǎ��d"��d�hC'�t�I|�@��OVp�n�tR���}�?XRQ�5�DZA�d�^"e.�#Cb�n);�.ΌH��7"M�� L���S �n�l^=^��ᑒZ�f�f�W���AD�w��]��n�-{���@���ԃ���J�Q��\g��T�H��S�����F!t�{�wH�0Q��D<e���_��0��C�R�]|/�)"c� #a� �3b�@�C2N��9���4��q{�����s�ާ�t�N�ab�ʊ��{���T ��d<|�i���RK�T�k)<���.��Z�r��OW{%��Е��F����ͽ�:<Q��JD �*�CB!����(����y�\q���%�����f#:�ͬ�K<1{��P�;[;����1��4U�ٰ�� K��aڎ�}G����>q���")<U�sCX �H�j�Pl�8'C��_w����F t�������^0:�+���"m]�F�գϾ������P������"9��>����!7=ߡ�5:���%��]�v٢>k��Տ����Oڂ��vZ��\x"��d���!��{3|Wf�eH�?1GX��#����=�9���y����))ivw��j���5 ���������-5k������G8��R_�����]X�4��Gʤ�l�:�4��i�<�,�S�����Ҧ�%a�bO�NV�x����ՙ��m�1�5):F7A��3G��:Π�G����:�;zs�����������S�tr͏V���B�D��x~Ց4�ٞʉps�z������Z��!e�2�V}DTj^�k�oͿ������� ��IR���B�����ej;�%f&�������� ImQ�?W���5�<�����1����`n��`\h+�z�X-�=��.c��LiZ0|CEwX��`�=@��ͶM�|,���|3r4@G����Q�����ޅ����t$L�-�{�9Y�Έ�f^m�W�u���,G6M�\t�r��֑�M�vH����o�[!2G#X��C��� ���6� f�w~E �1~����g�mWe�\�n�/);�*��j/.�R��T2����uy���[OY9�:(*k?j��[9��d�����yO��:�����=�����V��"$���>���m����FK �V#�(" ���GY���a�O�W�QB(;��Eҭ����/�[���������9�jGZ�<��Å<T$�6-CxȔ��.LRn{;/y�$T�������4Z��~c�ʉ(����`�s��w����Ӏ��@5�����6z8ܙ<U|�D7�&ψ���;� �-�nV��"MU��0�M^��%�3�O��ܙI�Nj��.�~����/�z��a�<[�(�&rc��tm[,^ݟ����6-�`8�eP4v��e��R Or�18�.�:��:���o���e܀�M��� �(��"(�Y�}!����,f����J���h�YW��$1Y�;�
Static task
static1
Behavioral task
behavioral1
Sample
NeoMC/NeoMc.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
NeoMC/NeoMc.exe
Resource
win10v2004-20240802-en
General
-
Target
8dd0053e701ce7f136a1001ac0a2f9d3_JaffaCakes118
-
Size
99KB
-
MD5
8dd0053e701ce7f136a1001ac0a2f9d3
-
SHA1
7dbf35645742c0b77ca8f75de23f61cc3c495753
-
SHA256
43a6016776bb9d018c393554ed343f5e7a147c3b6145c9b46d09f13fb4b4e118
-
SHA512
d5b5ad8bbf43d23dd2a74022436cc3ef22a81a8f624ec852e2cc0efe2922bc77f1c60dec63b97e26022c7afce310a11385410e2c3b6d3111d5f2ac18966b5841
-
SSDEEP
3072:+d8WLFK81TzTwLgXJcy5BOXuGfHfsb/L+KBaQhiz:q8MKLqdOyL+gi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/NeoMC/NeoMc.exe
Files
-
8dd0053e701ce7f136a1001ac0a2f9d3_JaffaCakes118.rar
-
NeoMC/NeoMc.exe.exe windows:5 windows x86 arch:x86
f167341434bff58b839c501028eaa6c9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateThread
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
FindWindowExA
MessageBoxA
msvcr90
__p__fmode
Exports
Exports
Sections
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.neo0 Size: - Virtual size: 560B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.neo1 Size: - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.neo2 Size: 103KB - Virtual size: 102KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ