���u_�H���0H�Q��,{����F�1��9?MδE�@���*!�6c���u:�S2���?������J�Q~Jz�-|��& m�k�B�@92�)�;�<$�T�2��g�Z�36��l�Ƽy�%d��S���e�<.��H���=��M��� ���B ��?�i�V`�F��'�H�.�{���6��ړXl���-��DH=�����`���2��'w�jO� -o�v?k��1�}�� 2������h��l PJ��@Y�Ko�\�4jiGp�HA��Љ�Sz�Bu��H�j-2��=Мq'^c��:r�l�J�%?7ßC� Ճ<w��Gj�N.����X$�ǎ,���P#������Ծ�����;�Du�u��lAyK#UAQG�q<��)M-N[���1T4C��Q�n����_���0d\��}+,��[2��:�?����A&����r�G���>���Q�a����F���q'��%ܜ>C*�ԜS�ְ�0�2=�"}�u����rF.P?N)��q#�s��*<"�9kP�y�P���t��)�-P��J�i�0�r��w���ҷ� �)I�tw�yt�6I;Dӎy�5kf����ĩ��;Bx]��r���L�٭ܾ�<�`�ݰk�&�� �!��0�/Zt��A&���>�"�*yg�S�3��գF=���9[k�Sy|����H��XWo��?� N{1���6�g��-�fA�7�tG�GjWOU������\�1�|B8�+��ʺxb�L$��*����-S����?$ A����MV��C �+.x�c�o}YN? �3��r�f%�S��D�8�������q���:���8K|�rZ0�_��j|L����ߝ�hp��@�P��S��a��s�x�����#���A��N�]X�*�?}7�vk���a�;k�nXes�ؗ^��������@���gRY5#]��4A�����=|���sTVxq�����a�z)*g3D�iE� 9R%JGn�����s�15���(��Ϡ�����7�YkRHEB~��I��� ���F8�a�5�����]8b�`�O���ղF:B�sUЗ��puC�} ����j-k�A�#������� x懦�~�{���V�w�����3�#���7�spߞ���-a��#٫*Kt����1�u�L��-};��zQn��\�=�A1�����h ����F�{���S��_wr�I���N��7��������m�[�~�D�c���6��~��_�ܨ��$���k,��٧��f|�ޙFZ��>%˲5Ķ4�~X���ä����;-�\s����G��F)���@�8k��=�I2N�Z���ü����Y]r�)G��c����-��x�*u]�����s�ҿX h�h/0��(���i�(%3���1���_+�,�F���'�"�iq�.����(�>gN��]v��6YkJ�K����(�F ^�����9��|OzP�E4�,6����`Aa]fU������f���E�K�>��_��(q���2rG�"��{��iM��K����=���~�EMδb����j�*}�SK�&�Ӡ�Tzn�]�)߄� ��x�Yb�hNX������?v��vq�l�S�e�yp�=|�Q���R9G�c�o�t����zo� �]��OQ�ΫX����ψ7J3hB#�z� ��3I)_�z��r��}/1���>�Rހ����u�,������]��P�����������} ���O���%S����E���:eP�l��(X���W�w��TM������(3� ���y7���<�?<PONP��2e.UA�ؐz e� V� Qrr��~u�Rf����MP�14��6+��$�Ơ���1��[:����8Y��QuT>n8ʃ�R���U4����N� Ʌ��h����~�+<��>�������=R� �= �Jl��;Ӿ���Z'_{md)=ܴ����챯WksA�g����$���+G��x�W���?���"����}��?J\ׁ��Ky����+~�Vo��[���d�'A%��>YW��5���H݆;�5Fٴ0��u��؋�sy����R�/EPUN��(�r���m��ն.o�/�4�N�k����v�Z�Q!Q�6M�}U�Д�4�8����p����"I��W�MC`�#�9���Df�a��Q���u�8t�]�^���4�&�}S*�Y��z�xta�_�L�sZ*�����Q"��J�rc��HD��a��}���f���yز_[2*��}�M���PJ�3X?�����p��]~�t� �q�q�h��X"_"`�c�)£��(��X ]\)��FmI�Ea��p|��ڂ��> ���/������f�ާ6XP�{g�b��|��ju$�� ���}��i�R,�� Bp~1&I'��t|��#� ��s�2�$��4̜��^,c�V� �,N�B���W�딬Xܛ������mi]��¾*��Gb���������귅d�&'�u�Sm�3�Ȥ���P�㧞;���"BH�W�*/�,VEB �W��� |�X�_+H�k�/�{���U��p������Kn(���)��������ICk���"�(ٻ�9���v�$F) �;5 0��W�rn � �n���D�r�[?�@N�<c�o_�a�g�z=� J(`�����o���]�=O��|��J}ʢ��r�^����(�7�><��O���[bkSU�#�=��8�T/��Q�$?�%�E�@�^�[�S�N>"�������*ѐ�ә�R�ʢ��H�?�T<����0�8�����r�;N��環��X�NC�i��3z�s4�vU�T<�r˘�"υq*u��;�� �� ��}y��:Ü�.�u'��f�����+�0���FI��I���+[�R����)q�$�~�*�^��>膅�W^ɲ��tR����K�W�wV��D��}K���vJ*]VLB�����W����4���2湎��Lbo�W�bF(���me��E�J�!�+��!E�P�G���g �¼�zQ%m��� g�u_����
Behavioral task
behavioral1
Sample
yy-75159全图.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
yy-75159全图.exe
Resource
win10v2004-20240802-en
General
-
Target
13636801598f1c30d6bdf0418f1fe9fa_JaffaCakes118
-
Size
1.2MB
-
MD5
13636801598f1c30d6bdf0418f1fe9fa
-
SHA1
a081a4d0c838e442f7158ef0d7ecaab2b51317b9
-
SHA256
ae9e7e212f400314be39ae67812748f24af857ee6e8cc8c885b78635d3948de8
-
SHA512
82e0b9eecbaf4286f732ec2b3179cc70c134f64463d357e1b62144de9435c889bd11157b49706a772c19bb64408fd9453d2489345ad7a326aea343d293bbaf73
-
SSDEEP
24576:kbMHEQfMsXYeExw9/mtohXV9CVwRm8ViBK/ZbAQmPTBs8xdhoo7+piv:BHEQfMc1Exw9eyVQ8m/KhbAQulsmg1pa
Malware Config
Signatures
-
resource yara_rule static1/unpack001/yy-75159全图.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/yy-75159全图.exe
Files
-
13636801598f1c30d6bdf0418f1fe9fa_JaffaCakes118.rar
-
yy-75159全图.exe.exe windows:5 windows x86 arch:x86
1689bb394cec75faecc08a06e706625a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiOutUnprepareHeader
ws2_32
send
kernel32
GetVersionExA
GetVersion
HeapFree
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CallWindowProcA
gdi32
SetViewportOrgEx
msimg32
GradientFill
winspool.drv
DocumentPropertiesA
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
OleUninitialize
oleaut32
LoadTypeLi
comctl32
ImageList_Destroy
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 560KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 206KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 889KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 56KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ