�ۓ�ݷzR�N!��>�O�������r�)IdlU�G��:6��`ӥ� �e���J��?C·��� I6a�����k�ƿ3�MP��}���\��^-�%�<�a\.��,Ηר��Ǥ��#�۟\] � ړ �Q �9]: �7uB dK���.�G�3���� ��1Q���c��;����`}`��Sq�����Gvm�8g�`���y��T�e�`�:v^��=���\x�<ɡ��k�<��D[q��H��%�ܣ�-�)mK��C[���ʺ#0��f"����2�9��K���I����4<���N��3`��䜽�-���ϼx���x����+���*PD�R�������o��d�3{m[�2@����S��e�++�z^�KM��"�O:�/.��:�CK�ۢ�R̓w���AN*�ж�=��'�_9Y�� ��5jԙ�%��Pc�d���e7s��J�o:Q�1�3��A� �����������_\��*_|'rDzs�<�����ޙ��!�W 'c$ݫ%�L?-��%�Gދ:�k�\�Z� 4Nҷ�����w�a�AS���浫#����oJhף�$ɭ�hPh\ȑ꤫�5���� �P�y8?�dܭ��%�� ��UP���%5���4�5vZ�$~i}���w*�p�H�ρ�Pk;-6� ��'A�nm�B�-2gq�{mD�A�Ҟx�sk�� 7�tv�H��H���A�{^��cu��1�J�H�4O3;�w��߿.Ϸ��r7 {��܈dG�a-×�)Φ�����)�/;���뽞��QAW����]��?��fG����]#qD�?���|�v.z��91��}����y�.�%A���1��p-9�,��~ki�sRG���3F��E;��:���[�����.����������8�Dz��{O|,�!��ʍ���2�-x���[ꆤz�7�ﱎ����i�R�x/2b�n���H4��%щ�ǖl��R{�w2`����F!���Q6�Waqt�Ɖ�8�d*{C~ l�2��x�����y�\�挥�˦�vB�|�ND,`]�m7�T4�2S DA ,�\N�6�2 eT�~��O���75nZޕ�<W/N̟q��itd�# O�3�x�Rͽ�2^��a��fZ��*s<����_[1�k�].?�= �7�=S!�z���$������6�$�|�4ރ�t�*µ�fX(4p$��oA��&7���_�W��k���G��`�>OӢ�C)�(���=~�=c�ݻ;֍|�N�Y�*IB�G��#��+��P���nHa�0ݵ��+�OnCjy����T��Ȅ�ύ�^�� ��� �X��������������nh�[���g�x��9Q�G77v�g��G����!�y�R��!�����p���R�E�u���<�R�걾�4s�[��{ZvT0���U�Z���o�z\B3'ډ�k l��mR���'5���p#��" h�S���~*�݅~zHEJ'D3�g���R{�=�Gԡ{q�����c�����UL*�&4超~*��b�-s���R �j�7��Պ�^�8<*N��6��Cc�Uu@l����(����1X��&f���C�+?���<Ď�Xub�9�С W% ]�~ ������#�Ź' +|/�1��z&���O�����>h=����Cnn�{h���w��?�6��������Z��R�R���c��K�{G�~�^oMQX=��d�B�Z�O���W���t�{����K��ϋ�o���S�C�U ����Ϣ�v,�D���x����U[M�����V�!���nME����g졪�K;4����N;�^�>�-I*^��0݆��.Zj!��w'�5�k�U���#�D�FS��;|���/�!��H�3��������*P�E���^o<��k��c�l��r��,'Z�@I]����o"qB�q���1�K�_�ISi�&�3mX1G�~̅�E��N�KU��i��iq�c t�~��YM�m<O�ߛrX`S�՛�O�UM�_.J�L��12a�s����E�^!J��+~I�d�JqH*i�$s������l���xs$��I&����I(�m�߱���`��h���A#��h�I�;��*�4�H�x$���������C���Mv��a��<���86���r� �]�~�Zn�N��� jhl���z�<���0s��G�_ɘ+�MG�c`�tR3���dk}��S�%)7B�V��o�m��>�5�=>an�r�elp���;���n��$�Bj��9��o�#�ER�4���IT��~��%�8��&��Q�� !Í�]N����i�+ ���/:��[<�:���[����U�Ĭ8�w�����݉H�7���`�t/��^տ�o���Y�����rI��/\s��T�i4�|��=g3����:��!G���"��\-���a����D; ��fL�j.%SW/��k�[�^k+d��� E�ӳ GM�o}�2�id�LcJ��en�mjw��rw�㳶%9�����Y�, ��� ����u�Z��65Zb�U��y���2�@P�R��t2��͡�& I�� ^�O��HbT��V�V�[�.��3� {�����aA2o�~���pA3ѾSp�D�u� ��:-�������P7���N�V�V���� %'h����3?>�י��ˉ����i6t =� >���i������Q�vƶ��C[Z䚟��<����$�>)���� � �?�y��uu����J�����F�cw���t �� ������H9� "<G]]32���v����ɩ)).�ii�.�@�Wg��� ֠X����T�F�&��W�̒�h�FV����ʢcv���v:�e���k<&)a�0{��j�`�H��q�!�\����[X�R6Ӗ����f9G�]3�^Fv'�b��:���1UF�%�����R�@[����Hh��z��f��8Tc��UG�~%�d֟���{O��Z弖�Em�;-�o��e���!TبC�ʆ #f`��������Pb�+{��2� ���� �8��x9{��� r����?R
Static task
static1
Behavioral task
behavioral1
Sample
keygen.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
keygen.exe
Resource
win10v2004-20240802-en
General
-
Target
d6ced1ae4f0e6c7fdbefdfb6698533b5_JaffaCakes118
-
Size
119KB
-
MD5
d6ced1ae4f0e6c7fdbefdfb6698533b5
-
SHA1
ef83742f64ff6cc9c06849c9e40aebc8d7802cfa
-
SHA256
2ddca48974d96aff3b5580b77a85c9118303f0a0f15c7329e3a667e7b349385d
-
SHA512
306abf94f647aea17d1354fe3ae5f7ea08b0452c47eeacd57a229f8f60d7ca55ee860199a79766b49c84eb4cd34116ef5ba3f5b80c9baf7a84c89a0ea791289f
-
SSDEEP
3072:ZqNXRAD6zyUTrfoWkZjHE3Gdw5o1i4b749g5qmdjH:cNXRzXAWkZQ2d0ab75J
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/keygen.exe
Files
-
d6ced1ae4f0e6c7fdbefdfb6698533b5_JaffaCakes118.rar
-
The AnTuxPucT.txt
-
keygen.exe.exe windows:4 windows x86 arch:x86
bb07f3ed5c868c860d85861cd7069719
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
SetDlgItemTextA
kernel32
GetVersion
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xxx0 Size: - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xxx1 Size: 124KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE