Behavioral task
behavioral1
Sample
FluX-Hacks Net CF Hack 12.10.2013.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
FluX-Hacks Net CF Hack 12.10.2013.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
FluX-Hacks Net CF Hack 12.10.2013.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
FluX-Hacks Net CF Hack 12.10.2013.exe
Resource
win10v2004-20240802-en
General
-
Target
0f5f749503f04583a62c729cc8ee6ed0_JaffaCakes118
-
Size
317KB
-
MD5
0f5f749503f04583a62c729cc8ee6ed0
-
SHA1
4b78391b002441b4adb119e99de069b53229dd85
-
SHA256
f383bce1b2651aa88b13d38ac94d9ee25b1dac658eb2f3d532d1aac2256f26fe
-
SHA512
f6f35db5564c6fc7d1da34cabad31cc3e5b702b215394a216de6eb859ae40e883407e8eefd71c6c5d82084f3a4dd30b931e0f8ac375461f58eb040c65ed404a1
-
SSDEEP
6144:+iyKVF9UTRcjEXEFqIdicJhpKoFIYTmVdqPvWn61WrsdA3by/aSzm:y4F9gXEk+iQhcYTmVdqPvlgrsdwW3i
Malware Config
Signatures
-
resource yara_rule static1/unpack001/FluX-Hacks Net CF Hack 12.10.2013.dll vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/FluX-Hacks Net CF Hack 12.10.2013.exe
Files
-
0f5f749503f04583a62c729cc8ee6ed0_JaffaCakes118.rar
-
FluX-Hacks Net CF Hack 12.10.2013.dll.dll windows:5 windows x86 arch:x86
35b029f44c69f515e843e1540c2ad868
Code Sign
64:b3:89:ea:ee:d9:f8:96:48:0f:d5:26:51:7c:93:ccCertificate
IssuerCN=YoloNot Before21/09/2013, 19:09Not After31/12/2039, 23:59SubjectCN=Yolo3f:ea:04:a8:ca:42:e8:bc:c3:16:ed:8e:99:9e:f7:b2:e8:81:0c:29Signer
Actual PE Digest3f:ea:04:a8:ca:42:e8:bc:c3:16:ed:8e:99:9e:f7:b2:e8:81:0c:29Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetVersionExA
GetModuleHandleA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SendInput
msvcp90
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
msvcr90
_amsg_exit
gdi32
ExtTextOutW
advapi32
RegCloseKey
Exports
Exports
������(��i�W��%��z> �"m�Št�|�=�����%��i�Xw_�iJ�/f!E�Q9UЁ*���p�rI��~P��#=b�q֏3��/0wh|�s��>��lD���ιT˜U��m�8����1��L&i��)��*i�?�ޅ����A�`_��\����M@W����[3+�{s�����n�푲S*0V��f4S�㮵�?7��@�~� 5v�m�љ�������R��{�{G��' �w�#�zK�"~�wǩ�t���"�*e��Z+���/A`<��g��þ>a��*Ep�R�Vs������.�����5��p��(��F�Ϝ�$2����-��0�<=�Ϗ��7�����f� tN����i#����O���9~�T9ւ���59�\R� eL����T� ���m�<���T��X9���J���@pҠ�5��,R�j��5�����)�h�� I5Y�`_�6"#�������Rr������L��շ����k?�[\(�+�ٱ�y��yD0�Eq+������V1��d����)��(/�����*@���@gԒ<��X\�~r�N���@��y!P����*Y�u��cU�_�v��+{r�{���O2�|���qB/�L<�]���y�e�j)��+�F��jb��@Z�-��V�d.�i��l��������&�����t*D����8���Gs����9 �ɯ�/o�}����?�bȊ�&<"OI93jɕ�N�s.ܲE���_Gґ�����Q������ĆU���8�5Z�����גY���$�7�d��'��âR�����m�����W�M��9�ñ[X�y�ec�����м��z*)��C�9�!�$�q{l].n���r�L[���e�yr^.����s�E��͓���?E�nyZ�g����v�%X��#���C_����|�%��pXIn���P/9���W�,&�dڹړ�Ip�����|C�>��dy?��J�W��,q��A${#UP��-������t������V���\9���K�����6��JF�F�� x�e�g�y��>�L���Q�GO2/]E?EW�R��ⵈ�"�+��D�⫹H����d��= ���z�{�֯F�R"�;s*[��$/ʧ��1XG�n���g�0u��Iw0J>g���g���5��nlU99�f��8���#��?�8V̷�[blga��!i+&�-�eR��E-V���3w�3�N��2R�p��Vy]�7������uY�s*T�_�mE!�)����X��Pk��ҏ�s����}(h��[��qO̭q�N�.�2�%!bs�����m\��Dg��e��y��kM�zW&Ԏ����������.��b>��\ �s����ʑޞu2䃹� K��o'�|��1y� J�$a���f-�1��.W�p2��xyTiµ5x�IW���V�K1Ȝ���4��7ַ����ΛWQ�3�x2ω��Q�T�Z�����w�������n�Q4p�&�� �&e%�2�wzϩ����,�SHd_T���o�K��9�GvI/�iQP��l�j�$�ǜv&%^�ԉ����f����un���vT]<� �E��v����[Ö��#���`�Qe��$2ˈ!���# �x�`D+�_۰�`����o�P��YA����� �^�:z�A��Iq�!���H<��( ��:ܢ��:u�Ԡ]���f�������7j�7����O0b��>βK$�o��(��4�e��7���E�D����`��wrh���E��Hd��:%��N�ش⛌R�����G��j�} Ġ/����}�|�T 'j<��";�?�ž Jyyb�`Yy0SFF%-�0�Ǣ�5�ID%Ya����Xd�<��<��t��%���P����ط���I�F^1,H�|�;F�%���T���$��s�ZۭK(�!)I�Ҝ.����%�'|��_n0�[�j�( +��Q*���l�P-�Z/ϧ��`��9J��2��I\�59�X���Yw���!�c搐���g��X�j���U$3��6��}�`��}2�"6a7Z\��ָ\=a� �pQ�៷tR�c�z��ص '�qu�� ����|�� ��!m�g��Ō''��u�'x K�K;�)��Z�l�>�R���16�`K��8'�#<�UG�[7p��GI�sg)�����걛�wjA���U�es6�� wΏ:T���lO�__4�HZx���S��z>U�!��f��+�7��������/?xIͺ4�\�Z�ߢk��:�n����� �4`.�R����Д��%�U�ׂ��baU=��V��Q1_�W��+�Z[ѳ��הx$� ����K�d�Lܰ�"����'���]���[2����=?�S�5�������H��c|*���l�U�{r�y��_����i�� D]G��:v��1��ܻI��*�d��(8�#��>>����b��)�K`j�O3���+�w��.:� �_����l�qg�~�ƙSX�J����&B���ڨ��H��&L�]5hϛ�N�x߁`��mH����i��/����栚I���8 ���&�������í7��H<�d�#����I�bhK�+ܡy�(��Ѣ�c}A�%� �X�[�)kV)���ܺ��ؖ0����>�^i*e�K�6�#6����D�O�(��_s�1 B��P��Ɣ�h`�b�P���-x B��c�;e����C1ٽ��XX;y:��رR����ZX*K2\��M�_N!J3A�ܑ�fټ� ;]Gd�K$�g��$g��ע����ၧg���n��Xl�pݑ��K�`�fTY�Լ;N�u����G�a�F���]c J<[}`�R�ݎ��Yr������&�@&��1�v8��S�X1$�8�%/k�o��@�>X�����lg�����n&�vl�1���Ҿ*��S�D�O�O�R�ϻ���.�h�@��\�1�g�(PR�yG{F{�c2��I��Z?un ����ȕ$�o�9&��M������Qz#S"�^�dR��E�2A�q����U����sU�/
Sections
.text Size: - Virtual size: 127KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 276KB - Virtual size: 275KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 308B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 686B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
FluX-Hacks Net CF Hack 12.10.2013.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 222KB - Virtual size: 222KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 101KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
ReadMe.txt