h8���NK����y�ۙ3]|�st�~�� ��M�����!��{5,�Ȕ��� ���%h*�kk�`H(�*�9jF�����ᇥu��G6�� �e��C�4f�nĝ���S���AD��"2#�w{�ew�=��/YM�����HxW`-i��R�0�GjQ��f�}5Tr4�a����"}CrO&@����^�[kt&�(~�N �hr{Q2A�e����j�8Q����@�I@g��̟P����� ���9��!^c,ɼCc���NO�vD��~x(v9ۍo�2�U����R�V�BAT��2����:k��[�s70� QѾ�B���?�IS՚���M�0���^�@�Od��xs���QN曄P�!�63��F>&�I.�:�~�e(ˀ{�,�DH��h��������d���#fqKD�K�[��l_��o��/�������.x���N1������Z���B������(qPɊ�#�*�#�:���cH�zQf���\[A�}���A���V��%��d�x�M����W�</(��8$�Eq������AY6�UI�2����h��K�{�4#�>Xd� �L���,k����✓S�"������b �ބu��^��VV;�\{9 ��2SVOW��VW_u����|8�Ru-vǖT?�����`$\p´go���R3��(��Hc��[��+KTPv�51��0���b��\�xt����ݑ/M��7���=�=2u�62��f!�R#�y�#�\F'N:����\h�sP�A횙�V;�8aV3]S�yZt��Qx���k}����B����b� u8��Ϟ���PV�-��ƕ�V>�����e&��.�БAr�I���t���� ��6��@�0�Q21&p��,'�m�W��o�PÑ �n��i+ ��&��$#����`e<{z� �S���Ko�KZ��m��~���Stx�� +&��Q��4��V8�����X4������`�✅�1a�n��-�O��x ������zX^��>�@1ؠ�'�:r7��s^= Ȁ ����ۊ�)l���T|�e�:r��6ë��.Xވ1�}���;������UK>����d\C8U��n��kO�7Y��І�|BQQ�IPyKw�?�4d���}������������K��j|�0m�侴�N��Pd8�)�vt'�$�;�ac���f�?��T�����0�����Ǥ��@ ���S)r���{�@ \q&X�����d����_!��ɸ#�g/ �VIހ��{������7�l|mgp�[��אڟ����+UZty�{q��g��T'� O�(�AL��|���\��ś]���`�ߺVC����w�L�^�[; ^G��b�y���u"gj������_o2�Q�m��K3*�T s/�F$��jīnh�<��L�uv2����6 ���c�n �a�o�y���t���� k;��v4/�ԫ��YS��}�����C�ݹ�S�4�w�q6��S����o���]�yؕ�a,�/sZ�����{�����92��F"�����4L)Z�\)*���t�?��:���{���l_~~n yڐ��?.��xӝ�t�!)����&�b��<�� /�EWu����k��:|�Ƹ�>ˮY��7�SLsZ�5R�db��4���sy6���?W��d�i�L�i..�!�@>B��q�[SϦ5*��z�Cy����[4t�Se�%Kߗ�D�&�[�홣�e4a�&�a�{ځV���S�I% �\��=N-�Ҭ��zP+�v�XN�[U�L����d�>2t9�|�;{�V%�f*���� �xk*k�-�˅�^<�Bj�ID#�:�����b��U�Һ�4�Ȝ��Q�1E�UL1� � �y��h�i3�~@�^\�gЩ�#�I��ܶT .M�LM��L+ c���/p��s ��D�Ӈ���}3����N]��(:�,�Z�%[P���l9����&���X��Ӏ�_�[5jصD8� �����Q��<vC�M�SѾ�d��Z�%��2���xl�"�#�þZl���K�ªYc%d����1�Qk?@`s����nдHu����5w��5�6�����Ln�%�]+�8��@��J�a@?m�A��De��R��h0FB_W�L$Q{T��qù0hMf�j��1T���ΦT�x����=�|D��.����o�j�������]���kbi%�Ѣi#еo1!k�Y٘���f�;�<6����/U?���bu���螺�|�z��6��<p�Л8�*N4����z���eߝ��e�9o����`����|�X�@H�m���[�y�Ǭ��P:��쯬����k��K͖�U��?�4�y�5����/�ކ�i)5�h֮������Ar�D!2:B�bN��h�OP�cs�w,��=�X<��Й�@�P�?]����`���VSzG����x����ݖ���x�IE"S���?��WL@Ci�����@��f���WU���<���c����-�LxO�6�~{����K5kI��8/کL7��Iv�c+N���GC����b�A��O��-��j\_0�q��4�ʤRv�k�^�N�l���y;���;u�Dzc/�2eJX��u�p&>�@6?��\������W-�aɳo�Cr��3�G�-��mW���J��?0F~T�?2k�D�^�N�x��QE��$��%�YrOį6�S&�x �r��5����QZ�/aJ>Dv�:�,]��.�o }8��]8����!���9��P��������(}���j���YKY�}�_��@f�!��Ԡ��N���2��2�yt^�ݍ�ʕi�҆� ��߹��E�^o�;5���ͦ�_B�S H���l�Xx���YF�~�C������,��*� 6?��Ě��sB����K��z�U�/�L�<����mԿP^X�i�bx���+���Cީ�XV:o��`ɒq�j=֚�RJ�E�)���z�B��v�}/�Y&�j�ֆT��K9�ڞ�G���`f���~��S���o&�V"NQ���HY���ý�\��z�omF&�����B�M 0���&�j��D��
Behavioral task
behavioral1
Sample
155ɫվ.url
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
155ɫվ.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
DNF0323.03.exe
Resource
win7-20240705-en
General
-
Target
abafdb04cbd04d6efd167649abbb3515_JaffaCakes118
-
Size
1.9MB
-
MD5
abafdb04cbd04d6efd167649abbb3515
-
SHA1
dc8d6666a9bfeca444bcbe69ab311249c5ea75c3
-
SHA256
bbfc8a1cfe70fc2ec45d3c2b2c8e14965848cc6d04609ca787ae4515d2a9ee7c
-
SHA512
58bd7eb4d0314596dee93776956a751e54ed1c026f75a6b8fcd6a4c8983839fbecd573e85f3711a5a767b8c44b7fa2eeef1a299e68522c27bb55eed845d7c968
-
SSDEEP
49152:K/6GK+/qrTBCv8v+YOt4DdWXvpHciCp7pKHcuwqzaY:KFKMqrTBM8Gjtc+hmp9KHtKY
Malware Config
Signatures
-
resource yara_rule static1/unpack001/DNF0323.03.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/DNF0323.03.exe
Files
-
abafdb04cbd04d6efd167649abbb3515_JaffaCakes118.zip
-
155ɫվ.url.url
-
DNF0323.03.exe.exe windows:4 windows x86 arch:x86
b06407a1c392f9acf6a1455aa3911e38
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
kernel32
SetHandleCount
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
ChildWindowFromPointEx
MessageBoxA
gdi32
CreateBitmap
winmm
midiOutReset
winspool.drv
ClosePrinter
advapi32
RegQueryValueA
shell32
Shell_NotifyIconA
ole32
OleIsCurrentClipboard
oleaut32
SysFreeString
comctl32
ImageList_Destroy
oledlg
ord8
ws2_32
inet_ntoa
wininet
HttpOpenRequestA
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 657KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 211KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 172KB - Virtual size: 186KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 405KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ