�-缿� �����C�9�=�Y�^Vd�RP��Eaյ�$�����l��Tj[�$��A��C�T�����9.�);ۆA��8[�(f4��^��ԟx���n�O|t�͆W^��vJ��C�bY[uN�?.~h��� ���^�L��Թ��L����O�Fl/!H�C�>vE�h �:���庳7Β@[�xq��/u��Fb.w��nb��K�/��� �aÎۅ�{D@� �yٳ���X��(D�Z��^��s���`k�<����T�.��T�� �o�#<o�hw]W���Or'����Վ�ۃ��C\l@ڒ�d�p0<�v�@ո%�[��8Dt;Ϧwo���{�¤/(�Ξ`n�)�|�S��Aq�Ł��w<�܋<�LS@lg�(@��!R��h� (O)�1T�ZI�s��] ���/���h����m�o�%B�Y���8 F�:�<�i RH�hC[�Rz��E5���ڽ!���?�����*bT��SX�<���c�l��M�r����(~��c-��Wd����X����j�XN��#�Zpޚ1��d.�Y�s�M�,Ȼ����i�Z@q虍���|��Y��s:����5�8<`5 .�&��p$�(z���~���r�����e�-��b���&�G��ʮ[�:�}����a&�S�Zl��>o��ޟ�'P��+I�_SBw0A������UA�W�����Q��=������3+˹�Cpn���mi%tw�G�����L�,�l8?w���x�IK���.���A���I�pJA��2_�1�W�?K�����h0��>0^%蜅D�ޝ���Ed{�gYN$v`�F A��c1�����'��/��d�p�)������"�h{� !F�ŧ�U���`�w�/�������ְ�C��� ���<���h\�@:�M�Qv�\�b�~�u�����R��i+F�mE���{\R���i�!�:r��sm����R��Ө����[������,$�♫0j��Q�|E��&+L/���N^�\��F�U�gG.��B4��Z��QT�6���� �]�W������c���� ��{�a� �0$�K"9p�`E��!K,�S��Ӧ��7+ղ$v�OGh��Sr�3�w݊�~�mn���kXH[��h3mvJ�T�혺vDݤ�!��%5�h=U(�3y�=\h�c����un��k�I{��@�c�꿀����$��$@��{ŗ��rK��-�T��L֑�"0 ��7��i�wQy�@�)eޒ�Bx��P������t�G`�77+����tqƧ� ��=��/-���bdF������YI{����Fs[�ΤX�B)i�����\|�Q��?#N��D,d3;è! ^m-�aEB���4�Z�Z�jI�p�)�l}U1����y�DZ�`�)�z���GT���������tz��SiT������8 r]Se�9�?� ��+�|T������]�)!����?W�f�Al�IV�K�$�����Y�zܛ���@ɻa����Kj�[!��<��Ze���cFn��JND�O�ug|`! A�rQ���@ِ���K$��)I��0��|n�'u o%&��cі� ,�4)r(���`\��*�u���B00�eWA}�K���b�߱Pm#~~6w/�w��#ԍ��w��8AE�M͐��UdJ�_3c��;+�$u`嗴��.ϨiK��8\��/1��Q]2C8É7�׀�Y�Y7@-"��9���w�789@BE?«�L�?�r{Ҥ���˯QX/.�Ȥ6��}q�`bʑ��;�T@�G���N�Ti��z�w���/�w�){x�g�L"[Tr��@��X�Z���l��*A��������/y�8��OZJ�F1]ɨ�i��N:���E���j$�독6B\ Q&i�)6��=��( �1,��^�j�F�� OP�������R�_u �'|�sd�������L� qE�o�jB��o��ܺJ:�S�����^�B�8�fI�x7�<֎��W���@��,M�k�������4[��Ev�����蠍�$��V�^t��.���H`��;Yۣ���|���Wq6?'���|t>=A�+��yG���e�L��}������{e6��h�H:�vr����}�����l�Q��ҩ%-�(��FS�F��0�btZ�|r�l���,ܺ��� SLC��9?Bp��4�U)�?<g�������z�U�;�wY��f�Nx:e�����T���ݐ-Mҭ3�"����㕁%�\6r}�aM��RT�;��(%��#ANc���7_���')�$-�/$������7�W�ʳ�!�iZ �o 5��o��lMӤ�>��x����Գ/��o��X;��~0G���Yk98]�Wa!Ûj�2� l+�� �֧P��xP# V�h�B����%��Ζ}%�y+���H"��)ޛ �Qx���]�� ��'U�>4�i�T�������3�y��#���]���=�����-%�\�dk����6G&�Ny ���������]>Q�Q���*~wbã1�e�pJk̺ƚ�e ��� �H�Y*�`���TҐ۔y��6�E�G~�h�C�iǡ��� ң}>� ���r����_��0��� ���#�# �xo:�ᰱ��r>^b7>���J���"#�j�JFP��(w��ud�6PP���-�F�4�w���7؆���T��Ӆ��2k5���Ҭ��f����2v"[�G���2*���OP�EXp9�.�M�H$%Y;S^R����$�O�:HK�7�ͯ𬨂�%ы�jD����gMD&��P���1s���MC}�Ƹ�[���υ��,"��!�X�.D-�š�I>!})R��axJ�a��Hݦ�7��-ɐ��3[���I�)����p�_����u�IO$@��K/E��%�a��3���FD���ݺ����M��r�\�黷jgH� \ꁝ+!���V�k.G�|I���^�W&�v'��#�C"g����lN�`ԫ�mH �M���O�J���|HQ�K���%�I�E� ��8*���!��8�S�;�����]��Q��6���b�1Be�� �j�*��� {�����9��:L7���=��.
Static task
static1
Behavioral task
behavioral1
Sample
main.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
main.exe
Resource
win10v2004-20240910-en
Behavioral task
behavioral3
Sample
mns.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
mns.dll
Resource
win10v2004-20240802-en
General
-
Target
15650985c4a2cc90dbbeb74aad931c51_JaffaCakes118
-
Size
2.6MB
-
MD5
15650985c4a2cc90dbbeb74aad931c51
-
SHA1
e9894c1188737e55e62a078d5a137fab314c310c
-
SHA256
7f6a075da150681c3aadb504ed0bacaa5c5a1d41c5b470cbaf1b08db4a4bd51b
-
SHA512
404b4228e4e4d0ee9ebc5456fa4c8e97bb375e922a10b4001bdaa3f86a412699bb6f1a812b8b22c400a0d3af9722732da07080adcb19e0c480cea17885f48d62
-
SSDEEP
49152:kxu7BsLUDGClJXbx0KvjidQk5bX2XgcwqxdbB0VvlRQOXHV2wODoH+5:9BsLUDVXhu5bkPdFGvzQM4Dos
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/main.exe unpack001/mns.dll
Files
-
15650985c4a2cc90dbbeb74aad931c51_JaffaCakes118.zip
-
Data/Dec2.dat
-
Data/Enc1.dat
-
Data/Gate.bmd
-
Data/Local/Item.bmd
-
Data/Local/Mix.bmd
-
Data/Local/QuestWords.bmd
-
Data/Local/ServerList.bmd
-
config.ini
-
main.exe.exe windows:4 windows x86 arch:x86
44ba0094c7901bebe998f065142859b7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
imm32
ImmGetIMEFileNameA
ImmGetDefaultIMEWnd
ImmGetCompositionStringA
ImmGetCompositionWindow
ImmGetDescriptionA
ImmGetContext
ImmGetOpenStatus
ImmSetOpenStatus
ImmGetConversionStatus
ImmSetConversionStatus
ImmReleaseContext
ImmSetCompositionWindow
dsound
ord1
ord2
opengl32
glColor4f
glEnable
glDisable
glEnd
glVertex2f
glTexCoord2f
glColor4ub
glBegin
glColor3f
glTexImage2D
glBindTexture
glFlush
glClear
glPopMatrix
glAlphaFunc
glDepthFunc
glTranslatef
glRotatef
glLoadIdentity
glPushMatrix
glMatrixMode
wglDeleteContext
wglMakeCurrent
glGetString
wglCreateContext
glClearColor
glVertex3f
glNormal3f
glVertex3fv
glColor3fv
glDeleteTextures
glTexParameteri
glGenTextures
glTexEnvf
glDepthMask
glPolygonMode
glFrontFace
glStencilFunc
glColorMask
glStencilOp
glScalef
glGetFloatv
glReadPixels
glBlendFunc
glViewport
glFogfv
glFogf
glFogi
glTexEnvi
glColor3ub
glGetIntegerv
glu32
gluPerspective
gluOrtho2D
winmm
timeGetTime
mmioClose
mmioAscend
mmioRead
mmioDescend
timeSetEvent
timeKillEvent
timeGetDevCaps
timeBeginPeriod
mmioWrite
mmioOpenA
timeEndPeriod
kernel32
WaitForMultipleObjects
GetExitCodeProcess
ResetEvent
ResumeThread
CreateMutexA
GetModuleHandleA
SetEndOfFile
DeleteCriticalSection
WideCharToMultiByte
CreateProcessA
CreateEventA
WaitForSingleObject
OpenEventA
OpenMutexA
MoveFileExA
lstrcatA
LeaveCriticalSection
EnterCriticalSection
CreateThread
TerminateThread
ReleaseMutex
GetComputerNameA
lstrcmpA
GetTickCount
IsBadReadPtr
lstrlenA
GlobalUnlock
GlobalLock
OutputDebugStringA
CreateFileA
GetCommandLineA
CloseHandle
ReadFile
GetFileSize
GetLastError
GetPrivateProfileStringA
GetCurrentDirectoryA
DeleteFileA
CopyFileA
SetFileAttributesA
Process32Next
TerminateProcess
OpenProcess
Process32First
CreateToolhelp32Snapshot
WinExec
Sleep
FindClose
FindFirstFileA
GetLocalTime
GetCurrentThreadId
MoveFileA
GetFileAttributesA
ExitProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetModuleFileNameW
SetFilePointer
GetSystemDirectoryA
lstrcmpiA
GetVersionExA
SetProcessAffinityMask
SetThreadPriority
SetPriorityClass
GetProcessAffinityMask
GetThreadPriority
GetPriorityClass
GetCurrentThread
GetCurrentProcess
FreeLibrary
GetProcAddress
LoadLibraryA
GlobalMemoryStatus
SetConsoleMode
GetStdHandle
AllocConsole
FreeConsole
SetConsoleTitleA
GetConsoleTitleA
SetLastError
SetConsoleCursorPosition
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
ReadConsoleOutputA
GetCurrentProcessId
GetThreadContext
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
SetUnhandledExceptionFilter
lstrcpynA
Module32Next
Module32First
GetModuleFileNameA
CreateDirectoryA
RemoveDirectoryA
FindNextFileA
GetFullPathNameA
FileTimeToSystemTime
FileTimeToLocalFileTime
InitializeCriticalSection
SetEvent
FatalAppExitA
HeapReAlloc
HeapSize
TlsAlloc
TlsFree
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
LCMapStringA
LCMapStringW
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
SetHandleCount
GetFileType
GetEnvironmentVariableA
ExitThread
HeapDestroy
HeapCreate
IsBadWritePtr
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
FlushFileBuffers
IsBadCodePtr
GetStringTypeA
GetStringTypeW
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetConsoleCtrlHandler
GetLocaleInfoW
GetFileSizeEx
VirtualProtect
OpenFileMappingA
VirtualQuery
VirtualAlloc
VirtualFree
LoadLibraryExA
GetTempFileNameA
GetTempPathA
HeapFree
GetProcessHeap
HeapAlloc
GetFileInformationByHandle
DuplicateHandle
SetStdHandle
CreatePipe
PeekNamedPipe
lstrcpyA
RtlUnwind
RaiseException
InterlockedDecrement
InterlockedIncrement
GetTimeZoneInformation
GetSystemTime
GetSystemTimeAsFileTime
GetStartupInfoA
GetVersion
TlsSetValue
TlsGetValue
WriteFile
user32
GetAsyncKeyState
SendMessageA
GetWindowTextA
SetWindowTextA
GetDC
ShowWindow
CreateWindowExA
SetFocus
CallWindowProcA
OpenClipboard
GetClipboardData
CloseClipboard
SetWindowLongA
DestroyWindow
SetRect
GetActiveWindow
GetCursorPos
ScreenToClient
GetDoubleClickTime
PtInRect
OffsetRect
GetWindowLongA
PostMessageA
GetFocus
IsWindowVisible
GetScrollPos
SetScrollPos
SetTimer
wsprintfA
IntersectRect
FindWindowA
ShowCursor
ChangeDisplaySettingsA
ReleaseDC
SystemParametersInfoA
ReleaseCapture
SetCapture
DefWindowProcA
PostQuitMessage
EndPaint
BeginPaint
RegisterClassA
LoadCursorA
MessageBoxA
GetCaretPos
LoadIconA
SetForegroundWindow
GetSystemMetrics
AdjustWindowRect
IsIconic
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
UpdateWindow
EnumDisplaySettingsA
GetDesktopWindow
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
GetWindowRect
RegisterHotKey
UnregisterHotKey
SetCursorPos
KillTimer
wvsprintfA
GetKeyboardLayoutNameA
GetKeyboardLayout
GetWindowThreadProcessId
GetClassNameA
GetSystemMenu
DrawMenuBar
RemoveMenu
EnumChildWindows
SetWindowPos
gdi32
GetStockObject
SetPixelFormat
ChoosePixelFormat
SetTextColor
SwapBuffers
CreateCompatibleDC
SelectObject
GetTextExtentPointA
DeleteObject
CreateFontA
TextOutA
DeleteDC
SetBkColor
CreateDIBSection
GetTextExtentPoint32A
advapi32
InitializeSecurityDescriptor
CryptGetHashParam
CryptDeriveKey
CryptDecrypt
CryptCreateHash
CryptHashData
CryptVerifySignatureA
CryptDestroyHash
RegEnumValueA
RegDeleteValueA
GetUserNameA
CryptAcquireContextA
SetSecurityDescriptorDacl
CryptDestroyKey
CryptEncrypt
CryptImportKey
RegOpenKeyExA
RegDeleteKeyA
RegQueryValueExA
RegCreateKeyExA
CryptReleaseContext
RegSetValueExA
RegCloseKey
shell32
ShellExecuteA
ole32
CoUninitialize
CoCreateInstance
CoInitialize
ws2_32
connect
WSAAsyncSelect
setsockopt
socket
shutdown
recv
closesocket
WSAStartup
WSACleanup
send
WSAGetLastError
inet_addr
htons
sendto
WSASend
gethostbyname
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
wzaudio
wzAudioDestroy
wzAudioOption
wzAudioCreate
wzAudioStop
wzAudioGetStreamOffsetRange
wzAudioPlay
setupapi
SetupDiCreateDeviceInfoList
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList
wininet
FtpOpenFileA
InternetQueryDataAvailable
InternetReadFile
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetConnectA
InternetOpenA
FtpFindFirstFileA
InternetCloseHandle
urlmon
URLDownloadToFileA
Sections
.text Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 208KB - Virtual size: 204KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 208KB - Virtual size: 136.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
mns.dat
-
mns.dll.dll windows:5 windows x86 arch:x86
a304127cc47f8adcf9877419a310db7e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ResumeThread
VirtualQuery
InterlockedCompareExchange
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
GetThreadContext
SetThreadContext
SuspendThread
GetCurrentThread
SetLastError
GetProcAddress
WideCharToMultiByte
lstrlenW
DisableThreadLibraryCalls
GetTickCount
TerminateThread
CreateThread
CreateFileW
WriteConsoleW
SetStdHandle
GetStringTypeW
MultiByteToWideChar
LCMapStringW
GetConsoleMode
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapReAlloc
GetSystemTimeAsFileTime
QueryPerformanceCounter
HeapDestroy
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoW
GetFileType
SetHandleCount
GetModuleFileNameW
GetLastError
GetCurrentProcessId
Sleep
GlobalAlloc
GlobalFree
GetModuleFileNameA
GetFileSize
VirtualAlloc
GetModuleHandleA
VirtualProtect
ReadFile
SetFilePointer
WriteFile
GetStdHandle
LoadLibraryW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapSize
HeapFree
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
RaiseException
HeapAlloc
GetCommandLineA
ExitProcess
GetModuleHandleW
RtlUnwind
DecodePointer
EncodePointer
CreateFileA
CloseHandle
GetConsoleCP
FlushFileBuffers
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowRect
BeginPaint
EndPaint
ShowWindow
SetWindowPos
DestroyWindow
DefWindowProcA
RegisterClassExA
CreateWindowExA
GetWindowDC
DispatchMessageA
LoadCursorA
GetDesktopWindow
GetMessageA
TranslateMessage
MessageBoxA
gdi32
DeleteDC
GetStockObject
CreateCompatibleBitmap
SetDIBits
DeleteObject
CreateCompatibleDC
SelectObject
BitBlt
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
ws2_32
send
ntohs
getpeername
WSASend
WSARecv
recv
opengl32
glEnd
glTexParameteri
glTexImage2D
Exports
Exports
Sections
.text Size: - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ares1 Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ares0 Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ares2 Size: - Virtual size: 429KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ares3 Size: 558KB - Virtual size: 557KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 434B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ