�s���C���WW��x\6C�q� we8i�[��ȿN�{o��<����[]I���fEKy���3l��w�B�'�҄�7E����`��b��X�g����a�(�L}ɉ�)��?+脖��搂Ao8<��6kOԘ����8�T��%�*D��:���jv�>�o�X���1|@ya�k:�c����[֤UM�|/ɂ���R�1���Y'$E�.�M�m�]_ъݒy�]�Y�-��hً�$h�l���B��P�B)W��l:#�e.ײ����S�����;u��_8b��aP���n�U��y����Wy���k ���k5�\�0}��LN.J��`}������u�.ٌ�Jky?s��ƴ�U=�g/L�����q� uaITڝ�&sKt%Ұh����87��3^IwFI��m����Ep�iႚMK�g�YKY \�{�7wٕ�}=��D[�aF��.t-�{Jg�ϯ;�����b������a�������/�z���N�+{�%�X���0��O��|G���ŋ��;*�ʏX�R�i�z5��� �C�y����3�!p�b]��t��Xga&���i"�ܱ��l��]�A n��}���.�X�gj43��ŷ-����+���Y�m����vD�/r�Y� ����J-��nb>6t�]h�W>�_:�����m3ݘC����>�!�QI� (�����`Z��-!}�a����7\������ ��\��_g�sR$�崮D����hn;L!�%+�@YB�y�G�x�)[=7npB��R���<��o$g�1��߇6��TP?z�H�ݝr@�6������pթma��~�V+P���,�"��[%��a�x�pn���X���c �F>�&�ide<��ɡd�?�s�̋���l7?ffrG�N=�l��m�>8���c�#c|����r��Qt|{��Sgt<���;G��>�p��kmh���2����)�Gc߹_⋀��M\��[|E�'���-���iM�!�`�+Z9��@���2q'xA�OQfğ5ާ�p����ƭ9���S�T��'}�����E����a��ݶ(~��a!���4��@�gf\����Q��XY1�K���t��QpZc3X*�4���i�I�'�;zz�_��Ϟ4�٢��=�p*7���� fó��ٵ6lSW�l����8~N�䓳 ��U���U���f�eK��Kj�H�!Ì����� ����0�u4�W�U�$�T�� �8��%ҵ$�_^�W����.������8?n8�a���;���:����.�6Y)��l�}���H�ʨq i�+�ȧ�H�[f��-y�E�~\�������S ��a��X� ����_��L.8��9̻+��ɀ���o�0�k�E\������5e}���D/��j�Mó �oV{�����Ҿ���:˖b����t������/34*�sw�=(�M[�˻�v��,�$������L��n2�j�ݰ�j�MUOYݱ��(��d%p�I<ϋ��2�匼E��cwñ��?�B��'��p�pR{��HU���<�]z563��"%3n&��y��/C@2lB�t�V�D��t���G0�Ĵb~��q�"�z%{UB��Z�[�NZuw�L��e���.�i�8��q��i ���+�l;���j�V�����6>�I 39a���`�*����cP��K(݃�g���bex���AS������u�e�f�+{;S�Pb`�z ��s�� Nh�'����Id�Φ�0uUb:���K�#Ze�j/*A�4��2��y6e�f�-$-�Xq>U,RGj��p�n��z{4f ������2��bI0�3���( &$��oIm��5���2Ђub%�?�����]��N�@�m�N��+��~�pR�=���B�����ο���·��x�4|d<��-��K�b�6ż�u#�b�TF�W@�햎ʜ�E��D݈�uFa4VӐ�փ����-�d�_�� ���H�ǂ�" ����ggްn�4�&���jw ɡ=?4Ւ��,�Kb�n��W_+��F�Y�p*0nq➳S���a@��۩-�� ��f^�V�$�3]�R�~�����1Q��¸��Ay����&O���-��*�YQ���=�]��p�A�G�ن���;~h}MXg��h��@�����eN�f���)���F� +�4�4�D@���C��/yѓb���nG�f���3;F���I�ԙ�h�P�t��L��p}�rt�*�#���d��pVۿn�8jG��4�DO2�;�X�6C���;�R�10yi���� sd�f����!�/���M��� U��z�j� ��Q_f��A�%�m�B�4� x��Dn�p}��hl[�H$��K�@{�CGN��"�ʉ��Lߙ�+6x'�f�#\Ǟ���{KG��ɨ�L>4� >�g��m�(3��]τ�rU�e9�E�F�d�:���@d��sf��-�%"@@?ٷ�dAmꋵ`�K@e/���nR�.�?[��m=�z�Q��(~Ӧ;Oր7R�,��Et6�Ác����aX��=F�݂` E�NH��0z�� Үw�<ްr8|���E����:O��<I��g�(�>�u�9��S�Bɥ�,G!��?��rQ:�0��g����:���:ʍ�m�t:��}5�{m��������ōR���?��[�[1 7����Z��6�b��\��#�������/�>�*�u֘p����o��E���o�}a��}�����hqr} QY����r �R���J�I�Nٸ`E|�F�%����&H�\^�����=��!��E�"�0A����<G$�&�Z��ލ�S�Tq�`��CH0�E��'��N���� �/���vO�G�4 �YzD�� �+�٠����`�߅-"� �3���HA1{y�+��"W���t�2wNń-��vf�v�^����L�H� �y0����D���� �×���V��� �8��o�`�S䲭�ŚJV5��:&R�ù�@ �=�:$K������t�����Ms�%�'n�z|v�ȺG�5�?,�T���G6�~���� �TO�;��'�/hZQ��8�
Behavioral task
behavioral1
Sample
DirecTX Hook/DirecTX Full Hook.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
DirecTX Hook/DirecTX Full Hook.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
DirecTX Hook/DirecTX Full Hook.exe
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
DirecTX Hook/DirecTX Full Hook.exe
Resource
win10v2004-20240802-en
General
-
Target
bce075fca41d9d8236a0bc0be9db32ca_JaffaCakes118
-
Size
508KB
-
MD5
bce075fca41d9d8236a0bc0be9db32ca
-
SHA1
8c085ee8967193c9efeb323ba618d0273db202f7
-
SHA256
b26ecce8dfe463e3f5a245888005b7195612688fc21bce57ecd291fead5a2b5c
-
SHA512
3f986ab335104ad649fba6670f27c4c72642a4679dcbe0b3c88d1eda78ee7ae4cb11ec42328195c74b674b3923f690385904ca4cf9f0fa3c976aad0ec538cf3c
-
SSDEEP
12288:HxQjr/LT/O7x/kfXzhitKJ4gjIUSVp7/vMM8ON5Xhg6woD+J7hTA:RyXgx/kfj+JRlz8c3gCw1TA
Malware Config
Signatures
-
resource yara_rule static1/unpack001/DirecTX Hook/DirecTX Full Hook.exe aspack_v212_v242 -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/DirecTX Hook/DirecTX Full Hook.dll unpack001/DirecTX Hook/DirecTX Full Hook.exe
Files
-
bce075fca41d9d8236a0bc0be9db32ca_JaffaCakes118.rar
-
DirecTX Hook/DirecTX Full Hook.dll.dll windows:5 windows x86 arch:x86
0eaa1a3754bd2ab4f137e2022de1650a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetSystemMetrics
gdi32
ExtTextOutA
advapi32
RegQueryValueExA
shell32
ShellExecuteA
msvcp90
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
wininet
InternetOpenUrlA
msvcr90
_time64
Exports
Exports
Sections
.text Size: - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.svp0 Size: - Virtual size: 187KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.svp1 Size: 265KB - Virtual size: 265KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 300B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 686B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
DirecTX Hook/DirecTX Full Hook.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.text Size: 221KB - Virtual size: 572KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.itext Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE