�-�-��@ܼ�m$d��EgQ�L�Ϲ�.��*��`gf$T����yC5�B���,䉕��W[$�#[�X�C'.���ԇ�d���A��p+�E%���/��[�NK�WD� Y5�X�;.-�%���$����煨�K\|-�#6�L���>D��n��)3��(�:��(���c ���A��'��K̏��)��չ^ �����S!8�H��Վy�� 7����\���ڹ��!�37꼗�,��DۺZxb���2�; ��H�Ì����~�c�5#Q�x�?�?Nnin��0���9^�^��2à��6(&� ��vJ�9�W!Ӧ���T>� e�9�ؤ9aH���T�cS����}�*�p���:���F��}��'��� �|ۆP��Ƹ]��D�@l=��s�]�̦GL ]u��*�gbw��,#}�7Du ��[��5^$� 4n�xVM��XIL���:=��z{˔�tkR���������M Z������ m�?��f�5�&��9F�D�L�e�*�� ��T�V� ��L�n�_�SZv���1(�:� l����^w�^���������ۊs{��9������u<�z���l�����-W�{��1�7]~���q�٣'�VV��7P����5'���=�IP �9{�h�Br�hՁU�����q�1o����n�1�ρ�<� ��@�����$I@��Vg���]�|l��=$d��XȬ�����ή���"˗�#9��0����-z���� �P���;�C��[�!\�1e�P�A]����Q�����o.�F�v(�z� ���#�x���NJ�E�Z�� �[�!���{��+�n��K^�(��֮ת��3ɬ�haٵ��C�9��q���0���6��h.�.�r�%��j�W(X�/��=�Nu�>{U $d@́�="����|u�z��/��AN�����`mH� �/pK���Ł��o��Ċ�r�&��k���3o���n�͉�Xa��<�>O`)���?o(��7lh$fЫg��4}�3xP�8�"�F;ו�1��D��(��@�kKf}^&�!nM-L���8�&���Sr�:��5�������2�v�=�����������Z�g�<�(���,O����.2k�S�b�(s���MTu�D�9��=:�)7�Lk;D��R����"��X��}��|����fV@i������|ur>Z\��p,�D\ %�_��Ϭ4k�}{�����3 ��Rzv&pe�CJA!�bY��g�4��ety�C�i[`�c����X��6��:0z�Z��V�F0cu�ۢ�0� �Y����%)���Ji�kޠ�"�d� k�f�"�85y��2\�8��y�����[aaT,U_U'�Cq�T�z."!���*(R7�zaG���g�6(���*S�&8��\'_�o�앸����8�\Lq!T��3���Nq��1���!�n��⨆ܦ��� ��S�N�)� �O�������p-<�*��"l���uPY��* �n,���k�g ��,H⃪d�-t�5�_��4 �o����q��=��c���xf���$�nL���͒&{m%���{h�D&#{�'U�|�ȹl��v����8�Am_��(�L�1�F� �K�ZP�� �����?p�� ����`_@uC�/�v��_2@�Nz�O�!�Wx2�9W�mP�'2�%��)o!���C���a�����JSUQ0�]�QD�Z/�Hݯ�w%�>.���lE>̨�>��}>�q��p�ț�r �*�Bb��'T] ��gKEEi��)����ݡ��iu�S\c�cn-�,�щ��9G�DK�L:[���0a����/�;Eo�A��4z�c�j�* �>gj�:cm�\�f^I}+��� F`d\�t`�:)*.!�{�P�&_ �R�v�-��m�*������4,uMhSxe����N7��Z��H��#�G\��TH�ƆL�0~���Dt�}^�S���9��2����;=���� � ���+�Џ^��� %��)-�)Auf�Dφ����/�w��Wg��?y���w�s1"�SCTLdI�K+���O;M���g7ы���-��4v�م6�6��.��ff ���=��@����3"��]�j�������p���}� �R�ז%_�p���s|?|���v��R���Rn۞��6�3�ֻ#�Q�n7U0x�LW*Vu�[�(��:�-#�@��f��~���j\�|���>r���;���M?�Uq��'l���l�WN����)|���A����SrkI��ް�@�š+���x<�����h4�'�C CJ� .$�˛��+ ck�����%kZwȰL`.�����i��r����39��.�UB��P�� ��]8)����\}ބ�=X��V0���� �CQKq���싼E�|!���_��""��X0(:�q�����v�Q5t��6<�U��*A'D�v�[ɘ-�+��ҡ��{A��F��=ڂ����Q��$��/ ^aAGY��z7���(-%S���W���?��*�]��x�/�Dл-�M:��̊�����1(ϣ`]Ӱ��\�Ր�?D4���7��H�zE���Zoo��d�����*���j<�7Ya]\�?���I;R�V�D������/PU�(��X�����;w�{)��9�4�;��p��=?��|l��6�����U��<M����]O_�_��J�� ��ů,��N>�� ���W�"F�?W��Z.�һ{����S��3r�m`�_�j��g!��Y �oJ�_f Y��9>´��@�lޭo��ԫ�r��sj���)r����������l3��{ڿ�Ѫ�&!�w�ɀ'�Q�h@ca�m�gŮ�8B��՟a"������Vb�K\.�_g�K�ԕg��1��*8յ�1N_l��db\�-�x�F�0�U�����OjUAV��r����W�J�� qk~����� ���DW25ǘ��O]2(��qzMV���ѡ�a5� AZ���Ő��\�;��J�����Ӄ�2�R�� *������62D~3�����ѡs�z�j���k!vFo�a^!
Behavioral task
behavioral1
Sample
ZaZika D3D v1.2/ZaZika D3D v1.2.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ZaZika D3D v1.2/ZaZika D3D v1.2.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
ZaZika D3D v1.2/ZaZika D3D v1.2.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
ZaZika D3D v1.2/ZaZika D3D v1.2.exe
Resource
win10v2004-20240802-en
General
-
Target
a0f2a1177561fe47893ecc2ebed7c1b7_JaffaCakes118
-
Size
201KB
-
MD5
a0f2a1177561fe47893ecc2ebed7c1b7
-
SHA1
c6aaebe031fb26c252385452d13c892c30b77818
-
SHA256
97dfb62fb779e0bb3283f002a731d6e581f7f3fa9dab47d81c7a795d039d4be3
-
SHA512
a7b900b50c9753e049efba5a569948809537efbf3238eba34b905e9faa1c36b5d21a2a44c1b00cd71d4c5b70e08739be2c61a04ec8128652adbcd65404479c50
-
SSDEEP
6144:9zTOJSy7m9lJAECesTubYwjU9KMq0JbzSHT9L+2Z:9PXEMljCyq9q0tzIDZ
Malware Config
Signatures
-
resource yara_rule static1/unpack001/ZaZika D3D v1.2/ZaZika D3D v1.2.dll upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/ZaZika D3D v1.2/ZaZika D3D v1.2.dll unpack001/ZaZika D3D v1.2/ZaZika D3D v1.2.exe
Files
-
a0f2a1177561fe47893ecc2ebed7c1b7_JaffaCakes118.zip
-
ZaZika D3D v1.2/ZaZika D3D v1.2.dll.dll windows:5 windows x86 arch:x86
3b37dada72b4007f7f0a2ff90bf7c679
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
SetUnhandledExceptionFilter
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetSystemMetrics
MessageBoxA
gdi32
SetTextAlign
shell32
ShellExecuteA
msvcr90
_malloc_crt
wininet
InternetOpenUrlA
urlmon
URLDownloadToFileA
msvcp90
?open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXPBDHH@Z
advapi32
RegCloseKey
Exports
Exports
Sections
_TEXT Size: - Virtual size: 431B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 168KB - Virtual size: 168KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
ZaZika D3D v1.2/ZaZika D3D v1.2.exe.exe windows:4 windows x86 arch:x86
c986eedcd433450c3b8f6181daf42787
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Process32First
CreateToolhelp32Snapshot
WaitForSingleObject
CreateRemoteThread
VirtualFreeEx
WriteProcessMemory
VirtualAllocEx
GetLastError
OpenProcess
Process32Next
GetFileSize
CreateFileA
GetModuleFileNameA
SetConsoleTitleA
GetCurrentProcess
SetConsoleScreenBufferSize
SetConsoleWindowInfo
GetStdHandle
WriteConsoleA
CloseHandle
GetModuleHandleA
Sleep
GetProcAddress
VirtualProtect
ExitProcess
Sections
.text Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.warhax0 Size: - Virtual size: 294B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.warhax1 Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
.warhax2 Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE