HnF�%���I�&lsQ��C�i��H��D7z�q.����d�M��@��Q��qΝ����5�>[#�A�}��$�%�I��]6�v ��;���)ͯ���u�Y�h<"r���-��F�e��3������u�� ��_a͆��Uk�{C�m���g�|a�D-e��&W ͼ�&���C�~51��EB�����l�*�9JD"����,�3s촖A���O��U0��p�#����@eL�ͱ�T�_����!M1��\��"��eh�������js�.Z2�{(�>���f�mV���O�埭��3كF��h�Jo)�`���Z\�F�Μ���0z$6�?����\�MH?Od��Y=}Q<�Vn=�0�Ӈwb�일�!ʲh�0W�_^�8������`���~�o�4�S��뫂 @6I!�L,���A�)�Z�e��E)3e��&Tء�%Ytu ��ҥc�Tk���1� �D<{�ep�3� r�WJ��'.>J\|�� c���2m���8�/�2��%3����_b�����۱�@X����^�?!�M�D�~��]D\�D��P�t�%���O��FL�Xd��O=ݑ<>�D@�Y$?Nu}�.Ze�9;f~�����d�'j ���tp-�,B;m�pĩV�b��k�S����-��~7�?W������Q�������^��k�!��~��3:��)�.V�L��O����bM}R��n�dq�oܼ�c�� ±: x��� �g��g�ہ���dڻȺ�1���>=��{::m�dG~��b��"|�a �C��1��Эq��q �>����!`����D�cz�*�XĴ��E�C��l��~(W�'��-�MFF�''���}�KE k!abY�BNCX���'?�9�]����ia����h�Gh���k���V���dyɒ��<�/5��<G�B-fK�.�"�T-g`�?�sĩ������� V��BT,}9E[��f���#��-���>�@��X.�㩍" �o<e�b��?����� f%,�&����`����$͛E�j��Q<�ħ��H�ٙ�ު��2Y��#*� <f@j�Q �X��>���$����QC�35��)��h� �6Á:�ܼ��&N�-*Ӑ��ί���ž��5ɇ2c#O�2��:(��O���6��}+�sZ��B?d�*:q@s?�N�eL��"�&�}�ҵ\�Ϟ��v�uY�c�I#3�Z8�-��j�F9�r�(4n��&�P�%Em��( �a+���)��ϨSV`���L�z�ZZP�h|�G�0Q��� $�P�i�<!X��|��њxj(7�3����1����B��r���n�,guǚA�ܤ^��H�{�<Qy=�%B?R�pe�[�l���a���%�M�萢�D�������ƈ*�������M*3�?�!_����X0�kN_E��wmnS�,��Jd n�&i�&���u�,q�m�"sn��n��R�4��� 8Ţe��K����"��w+$��`���VZ�2[�-\���w�x]��6X��K� �N8����� � [Unk��dz*�3S� ���5d���;ԟ��S�u����fCq�Asb"aEBGA��͘��r�5f_�bS���ecY@p/��?z�Y��n����,MI~�ڞ=���!r�F� ���A�Wb>^�q�r�v9a睌a����f�� �f��m��5V���Q>Z�M�s7�$߮���^�`���cW#� �ɜ~Rɿ%t��R�A�[:�Y����)��a,1W����� v��*�ݧ����5#����&&�iC�ٱ���Su�R m���JT���'�_�L�3BG�?˰�Q���eDi��?U|_�r5A:͓j^8�����S��k8Ђ��������P2�7��������lI��'�,|��RyL�kb����Zi��� w1� �r���JXD�ޯP<������0�Im�܌ȝ±#3��e�+n�`.a����Q6p�^� g|O�c��M�.EG�5(h�z�G�ܩ��#�6��Y�q�qz�S��CӈD:��:�n|-�����/��Cg�?.��l�9������x���e���l����Ժ�X��|� ��ϣ���%��`y���#�QL�%Qa�{�����%��tXM笖�Nw����'�fտ��K���8j�i)*����M^:�3�&�^�V���N����rHN�LWw݄.�_3��v�L��&���]��1���\k,pwq 2g�6 �AnKMo���e�/�?�]�*9�P���]��u® �I������� YE?8�Ð��X����ov����3G�@f�W�[I0����j�F.ĻO,"��\P��La�� ����U�.��E�y��� �v� \_�-�L�_�U��ze���C�T�Ͳ�3��s�D��$M�z�7M�����x@{��X�_�@Q��c-�#�ɷ�� �68�����I#N(�8£p-n����G�ne6����H@���="(�}�ʘ��jň]�,��-�bc �ȋ�^�#aGc �` @�u�y��B<Z��3V�]��HH�,�9Z_��w���l��l|n��Hwzb���3?c�����ӆ-f�u=}�Fõ'������0���.��=�p�Z0ߴ�y���}�FV�'v4"�c�ljg^��] ��Ѽ=������r=���5�l�|T(��Ϩ�&^�x��:z=O�Rݯ��g��h�^8�b���E�V4t��v���#��1H�ߎ XM4�i+~��9`���d$W���߈��u%�����\���Y(�_+�yإ[�<.rL�0zr�MX��0R+v�����jL��y�����%�4��Eh��M��,3��!a4;?�ٰBئ ���2�u���[����`��/�H�8*v<�ʜ��i�ӗ���^3�@e��` ���zUQ�.� �!�MA�e�qh���( ����h���'������Ė����Yaw�^]XCn�_5�2�@%x����Zs�Y�R��_��E��h��D�L���g�����<&>��ows� 3�m-E$"�n�1��j�Ƹ����&t�NsoW�G_�i<E�5��
Behavioral task
behavioral1
Sample
独霸休闲.exe
Resource
win7-20240903-en
General
-
Target
0588870637bb62a9ba642499daba7161_JaffaCakes118
-
Size
1.3MB
-
MD5
0588870637bb62a9ba642499daba7161
-
SHA1
a7df775a36514c2a68246eb129f663aa114d028f
-
SHA256
9175ab05c07278bec1da32de8f499e5cb1fe2ed714c30093663b7c8064a6574d
-
SHA512
369121f651b0b30ccd8c2da702039514547342430e67b74468a3cc8309ac26cf0fd319f4be6929779221a14b21405d40b161f83e7cd302cd11207e2e510adf52
-
SSDEEP
24576:YHyY5fdw5BRyMCpTFRLQsyHiIV9UrgkEPYJT7MLD79S7/j0hu4yG/72Hu1s747iu:Wt5y3R7UzksyCIV6rgkEgNIajGyO1R2u
Malware Config
Signatures
-
resource yara_rule static1/unpack001/独霸休闲.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/独霸休闲.exe
Files
-
0588870637bb62a9ba642499daba7161_JaffaCakes118.rar
-
独霸休闲.exe.exe windows:5 windows x86 arch:x86
0d006bf1f6444adeca9da25fa1f56320
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
GetOEMCP
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
EqualRect
gdi32
CreateBitmap
winmm
midiOutPrepareHeader
winspool.drv
OpenPrinterA
advapi32
RegQueryValueA
shell32
ShellExecuteA
ole32
CLSIDFromString
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Destroy
ws2_32
closesocket
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 489KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 201KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 862KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ