��"��M`c��dz�?F��Qֹ�D��@ p�2тG��ǹnH�5�p��bzz(��&9%�Q�3���=[�l�)M�~�:<!�j����֟��vxK$SQȏkd���-r�8��y���CZ!Cqjr^6 ���a��"�ڽ�2S���!�m1��ȵ�w86Q���X]=�����LW��O��������b�y�6|Թ?ν�ʀ1�\���\��&C�Ik]mt;�)�m���g�S�&ü��t����n�f�)p�dp ��,��ϥO��XJ�t'/,�-�-r�Ԭ��uP\(n��䶳�=�yT(�����&e���Fs�,�����f�ϧX慨�p�cL��Ce�� 1�:�Ej�)_���c�A�ս���o�Xv��Q�O�����?�V�Ƈ���u[�ba_�\d����$M/$3I)j�u��B(DFn{�.���?kf7�5��x�V�)���̚~�~��E�(z܂dg9lw���E ��B��09��@�eU�5�G�r�� H���.�Q�9V��r+jR�6d����pTS��aU���g�������(�~�~֊����c+���^b��APV�/?�W��VhAp?�s���p_{���nJt�sn_�.�����$��]�x�\� ��Yt��{��t�;�{���c�<��iP X��|��8��ԗ�Q&JHr�&��K����e��K��T��Y�X/{��.6���>)~%�-�h�,�Lf^\��'�� ]`Z������*�;̜�g�E��'�)Z�G� C��o9�%� Pi����)fO\�{z�:~����&SK�O�{Bċ�<�?��A1) �V����x�a� \r k� ���3�B��>6�z�GI�_~F����DwW%*���Q|�M��������ׁ0��SVTT%��@� 6i �Ý���D)�WF-���z�4�m%g�^�Rd=�����'�W(K�(��6XHu7�@�]�� =]�����5Ѳ�Slc�DEMK�r9�>��JOZNSI����� h�7�=��y��WiQ;s)m���v�����B9��M�˕�\��R�T?���wٕo���Y��q!]�x.9muSmq��G����B����m�)��)�2JM�U�A��H��/�k"%��l%U,��)�ښ�����T��$M4*�:��)xC��,���dž�*ދ�;�1N�����n,���YB�WHI.օ㙇�`i��yl} ]�!7Iz�����te_y Ǧ�c��.L���o��@�D�{�n_��7ύ�߇(������O遵R���´�!���/�b�n|��T���l�/|�Sk��"vP�N7�2�zG�����b_�h��*Jq���x"�h��PL2;_��T����(|gZ[��rQR� v��}_�� ��.ާ�X�z�SY�:}����O���z��(�1��q��W�{������j��������GR�Y�J'�i� ��l�N媃_���4v�>�ݵÔ��f�P�`�����T��_��o�d2]�� \4�Tfx�6c�B����e*͜�W<f��Ы"~�Po��t��G���x��O�\��+�/��"�c�f�%�XN vxv5I�m&�~S�&i�A��*��U(�Jloa�)� 'F��j�D���&�mXbE���$.?�a&��Yj��Kk7��t'K���W�S%h�\���b�R�#�����-ҵ֊z�p�.vu��}�?@�>�c;�5MZ���nIY?�&��\�] �=��ŦJv��(M9�� �7{ɗ�3�Թ��R:ժsN��"������q]d������ �J��Kj(�آ�`�7��7�y�3$���b�K�X��n�Fi^S��/�ϠB}�tht��g/�#�r�2�3s�w���V�������zB��q�����Ht��!���k0�_��D�B�-{�m]#`P֘��܃x?�;��]V?1�l���I����HG���78�H�������8i,�֮��[tU�j�� ^��k�b�i�}^���� E#!2�A�38��}Kiޞ~�{? f?���ʋ-��+;&s���n��=;�Ү)�������_ޗ.��Ax�'lյ���D������G�HHk3�sf�8��L+Gk�O=�v��j�����֘�b[��:�aN0��^��)�����H0G�z'��]P�iy�1�P�'�H���L�rx�K�D�B�EV0q���ǐ�i{E(EDp � ���k����W9��zr����r��;�Y���R@ݾ�6�vI���*f��r�^a�9J!�P�l&-�h����D��?������@k<��2['mp�x]��H�5�%M����|?�Vu�� paQ�PM����3��WQ� ߛ��-#f����A�/��]��|p͒̿�k��8��dO,���D�Ҷ�z9��� B<<~�c�UVi�eQ-G�yd�-d�ٳ���S�q����2�Jǝڭxڋ��D�Z���Y��W�[B��Ή:-������i�&/*��ˑщ3K���e� !�Wl�����6���d�w2Z�%�;O����cD#mhulY: ��Pe%�W�8c��uT���W�5L2(ICG{�U"ݪӷ}�v����$�/���w ]�K��s_���y@]��kh��e_�+A���?�͏s%&������[L�+�����x�զ��M��~Y�ZCp3��I!�.���7)�����&l��rY���i�bۜ�B��2�ч��ӥ~�:l�R���~q7M8}�����4r!�=c�%J� �����Yrq ���<f'*�E��iwL͏Y�%� L��A���H�4$�w�fy`����r�=��j�N�8��V~z"3��9?A�m�0��@PTR�-}J�88��߶:6)Ӓz�$�hs��e4�|�ҭ����?̩�q�9�]1����|��`�}���1+���G{��(s䇻���� 7�����Y+>%�2��@�a�Z9�ILS���2O����ĮK�Ϸ���Qr(��ps;�N�h�|��0�j�&����+6��;���k;��c�s|ES�1���ݘ�����Fn �!F)��&
Behavioral task
behavioral1
Sample
X1N3 AND CFG/1.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
X1N3 AND CFG/1.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
X1N3 AND CFG/injector.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
X1N3 AND CFG/injector.exe
Resource
win10v2004-20240802-en
General
-
Target
dc89f09446e9775ea731ada3672507f8_JaffaCakes118
-
Size
7.1MB
-
MD5
dc89f09446e9775ea731ada3672507f8
-
SHA1
6afdc2057aed040c2589a85425605463c9184a3c
-
SHA256
daa286b10af9d392b0e6f7baa58cd6905dc2bdfc7cedc6ae3917209723f5de8e
-
SHA512
37350c7b5ad242add4d2fe3b238f3ae010ad708ff460dd231ff8777371ddd373ed68a20a0da0cdf612e2dfa515a54156f579ef38a37d9633138e4d951a75fb3f
-
SSDEEP
196608:TJUQ0r1ojnhrWi5g1AO79wmD1Nxai7q2QcVkUq7X:yQ0r1ozhYXOmD1ftoT
Malware Config
Signatures
-
resource yara_rule static1/unpack001/X1N3 AND CFG/1.dll vmprotect -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/X1N3 AND CFG/1.dll unpack001/X1N3 AND CFG/injector.exe
Files
-
dc89f09446e9775ea731ada3672507f8_JaffaCakes118.rar
-
X1N3 AND CFG/1.dll.dll windows:6 windows x86 arch:x86
4c61426fb486518025f38198d333c5dc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
MultiByteToWideChar
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetAsyncKeyState
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
wininet
InternetOpenA
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.2MB - Virtual size: 7.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
X1N3 AND CFG/cfg/1OSNOVA.json
-
X1N3 AND CFG/cfg/BoxEsp.json
-
X1N3 AND CFG/cfg/RGB.json
-
X1N3 AND CFG/cfg/YouRF_Legit.json
-
X1N3 AND CFG/cfg/ffa_hvh.json
-
X1N3 AND CFG/cfg/legit (1).json
-
X1N3 AND CFG/cfg/mycfg.json
-
X1N3 AND CFG/injector.exe.exe windows:6 windows x86 arch:x86
246ab0ca8645a7641a1d6e2072a5fac7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
C:\projects\2015-load-library-injector\Release\injector.pdb
Imports
kernel32
GetFullPathNameA
CloseHandle
GetLastError
CreateRemoteThread
OpenProcess
VirtualAllocEx
WriteProcessMemory
GetModuleHandleA
GetProcAddress
CreateToolhelp32Snapshot
Process32First
Process32Next
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
vcruntime140
memset
_except_handler4_common
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfscanf
__p__commode
_set_fmode
__acrt_iob_func
__stdio_common_vfprintf
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_initialize_narrow_environment
__p___argc
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_controlfp_s
terminate
_exit
exit
_initterm_e
_initterm
_configure_narrow_argv
_set_app_type
_seh_filter_exe
system
_get_initial_narrow_environment
__p___argv
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 900B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 396B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ