^�M�5���?p/k�c���Q����?.HX�bv����J�m@��Kf:�����OG�:���6���'��B"�[�j�)jRI��+�RO9�ڪõ)4�k��W2s!���eB7�W���� ����J߅��25�dҺ�RP��T=t1#:H����`9��KX�ck6&�t�����y��h�m�����2Tt$��ӧ�����S���+����hԓp'���Q��:s��`"ƚ�ݕ�9[�nU��S��)��=y �hA.�^d�U4W*P������V6���`@ʨE�����%�1$��m��|�m�lʀ�<�@O��]F�)�nl����82~A��# %֢���d�����Dܡ�9h�QSЍ���T����CP2�/ ���g�r�0H8xg]_-��aV�yy,�?5��4]�����<a��ќB:�=7����i��mnwzs �)Hb�a,e���'�~�� �OH��Eli��Qlz��H4�\v# �z���������l��H��'���<�����L���&OJ����8樉F���f�Mõi(`����.�4�pi�K(��X����r����OP����k�z��M������@A( �ȶ�����.3�Nz����ͣ$�eȁ�� �E��.]�gr��}"_5o�> ���3�ʘ�݁/NB�%\C�����&��MΦ~�w^v���ZKԇ�`��(Kr6ä��P�}Dղ��>�ID#��Ň�_e����7C#����?f�H�D��0o��Lw��gξ�q��2���uoz\�V�����Yz~�x�WAhʄT�.EV# �R�-�r�i������|��8/�z�_H-�b��� ��rds<�)����V{ȿ�S.'\�����h'���}�,T�r;T���~4A�����1�8��H�=6e���5,F�u:gI�H���K���]x9t����C��\�T4��r 9|`�8T8Uj�j)�?c�X��)��;�@X���g;c���&�Է�J��f��U�C����M͔�%���J�p�DY�w!�W!�]P>�T�8Vc�0��G��#@-�����X�&�����3���Ag_�os��?�������r9�#x��o�qdq��ʏM�\���H�qC��������_��W���ioxة�vl�n��r�a�e��vm�������^@�I=�D�ibf��e� ��u���Ag(�E#pį�?�t�ܙ�=94^i����]�����'`���YFyxe� � JC�˯�9���� �֒�l~_n�(��ϭܞ������~v��������Tb��g�&c�� ��ցa�`���j ���8���^]W=L�9���uf770���n�([�-&p]��W�8�cK��G��5c �*w2�P�WK�ޭ�B;��Tȫ�aF�u��5�Ϯ^��(/��Pr�p��o�2 j�����-VGå��m�Z��8�HE���18*�M 5Rp�֩�C��L�|u2`�[6�4�&�S�B/�N������*&?�m0�ng �֯�7�}@v+n�z��(���Z�U�% ~�*���do� �FsԚ�x�Ѹ\'���[�##&-�DW'S��n�6 ����E����vb��?E�<����>�z��0��b+�$EM�ĻDž��z��#�u��������.f�v�!��V��pϔ�t3iH���3s �kd-q��{�M�L�j�N�}6l�)�*��ED�aܢ�%Y�4cu7{�:���<h�?��2��~��� ��ԈV!�t92��틌��O[��:p8F*����Ԗ�-���+9��1Z��x´���>�J\5�FX���H�^M���5�d�w,b���Mr�=:����?ڿ"0�tP��y�m27L�:���U�7�q�ٽ�V���I�3w���/�ʋ`�җܢ�ZJ��%��mM�����.��Ϝ�{��2u8�q�`C�:f���!U�)�����F@�5ۃkO����'5���MB�Y�Ab��_�q�h���N�����)Xy��U=�YEX/���¶ ;�*(��������p�4�|�p�,HZ� K� �ܧ��#�x��5�?�㑉�275�L6�⸩�f=W��šM�T�MbB������U���#xFЖ������A����`��;'��hVf`w<�ᢦbS��|�m���Li){���k�ᵥ��iH3�v�����u������MuE�XZ @�=�w P.?qx\����;_�"S����ez��@E�#���X�[�ô�1����ȟ���oN���� ��{�/ЊP�u�9����3֚����{-�����F�y&�>� ��~TJ�5�$T ~-�>�6�X�.\�&�H�< �G�w�U�l���(|ܷ�o'x�xVy5�~�ߌ���h?��Fu�Q�鎤/�f�Ln{��'rq}W��Lxc��{�����P����U���W�Կ 5���4P$�_خRp�)��G�U� ���o�f�R�nK�p�6��M��X-�s��.*^G���ʠ���(W�bQ�mA]�6c��2�|��.(Q�;OI�m���y�Fr�g�u�S�>��Y���?�⮪c�����UךϿ��<T85,�i�W�)$�7����fq�"�!�U� ��G��Wum�;^4^b��g��o��ٜ���9��-þ!�cDž��K�;ޫ��'K�:Mn��t��;k�:��Ո����$8�n�������yQ�C7Jh� ��&���'H ���wsDJ5pı�X-*ϕi*�2Y�0�8��[�͌��� YSP|5���ӵ�iOL`��s��-t��~�q�dr�����z��y �E�q,mVg�@?����z�������x���I��V'��T�`�~xd��Q,)�}p�z��w��X'��Q\�=؞B��D$ğw�O���v��?R�4�' �Eo��+�,��`���'2l2Qˡ��V�.��j�`�O��h��s������z�wX�ʒ>e?�� �����82T4rh�{�4/��!!S���97�P��� �@�N�O<!wL��Uw�x
Behavioral task
behavioral1
Sample
zs.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
zs.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
zsLib.dll
Resource
win7-20240903-en
General
-
Target
45ae14b668686c9f8377b27a05a8d6aa_JaffaCakes118
-
Size
620KB
-
MD5
45ae14b668686c9f8377b27a05a8d6aa
-
SHA1
f6635804662df16d9c0cbfcc02bcc5b699d8639e
-
SHA256
bdefb77b23283c00271cb62e030bd40e1c083ecbe94e6670dd096c14f3ce434d
-
SHA512
8d1b6cbf55e3da1d9cb6967961defc3f1c9734e5b516291d8f322dee80b58116bfef8f36b6d1baed07a7f83da2d49f6bc3a3c7a76c42275c77bb409f7a4069cb
-
SSDEEP
12288:p+13p0vPF5aegY8L9vTJVYY5SwCJPAadroeDOYu3AMM1SHozRHH9C:Y1mHFzARPYhJPVNoeDORHQZw
Malware Config
Signatures
-
resource yara_rule static1/unpack001/zs.exe vmprotect static1/unpack001/zsLib.dll vmprotect -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/zs.exe unpack001/zsLib.dll
Files
-
45ae14b668686c9f8377b27a05a8d6aa_JaffaCakes118.rar
-
5762Crossfire20101226_0003.jpg.jpg
-
zs.exe.exe windows:4 windows x86 arch:x86
1b1ca09774dbc5d4894057aaf7124fcc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord2055
msvcrt
__p__commode
kernel32
VirtualAllocEx
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetSystemMenu
shell32
ShellExecuteA
wininet
InternetCloseHandle
Exports
Exports
Sections
.text Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 200KB - Virtual size: 196KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
zsLib.dll.dll windows:4 windows x86 arch:x86
9e4340a9524ff9b2b466b0b82bf7932f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InterlockedIncrement
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CallWindowProcA
wininet
InternetCloseHandle
Exports
Exports
����c�2�Pp�W3e��|Q�v�����F�}C!̈́���.����Ѷo`����^n ��Th)w��q�n7]⽤k��ۗ��+8��Ywz�����V �<Z�<*W�p��d��EN���Ąt��ߣC��C_�a���i������ڌ�A1�e*�(��ڡ��SVu�8/~9{�����9Ne�Bd6���G_E��x9#�>u64?Q%J#�?~d���ChU���_$��E�A{���4�@t$@��f�c�0��'�u��++�R �5�Uԡ^���Tg��F�$���q��T5�#���%��ǭ�b8���B�4m��5S����8J�̜X��%�����^�I�}�R _z%]��>��I �;��<���t�:~�������x���fs>��̀ 釳�WϮ�>�4�V��j��!�,�b��7���P�r�K��x ��L� �YoW�p_q|#T��bAaȀ�F�.Qă�6yFS��7��Z�u,e��bu�7���e��@H��)2��sz��变ҦA� �'l�8����R6B��jr(L��8�U����j�]�n��J�J��D��:���;�>g���� f��P�=w#��Dz���� ��lx�M&�o�(@�CN;�������A;��m ��GDأ�x!�X d������_��[��hm~+��bUn��m7`r1D㠷:,��*z��%r'a�����@��;��Ɲ3�/=`m��C�b�#w�m����>��BE蠷!����&�=��ȩ���۔��S������m`=��?���<NG 'v�R<ά���0������9�ձm��l��<�0���o��Zy��椾��յ���羝5fw�O�P,���� ����}7=�s2g��� �]M�a"�l�a���0ǍRM���՛ؖ���2_��ـP]�]e�.�%�9��j�~2<���=}7��;뇅���w�1��;N��������C3�Ds�ڹ��'L�q���_C,�.��)��8���À �-ʾv�$��Чve�.瘑~��b�ښQ~���8 ؒ�rz��p��^S(dMi����5�/x����؆\":�=93�����ݏ"h�k�iI�rsE�>��?i_��Ð����HTq3������M����~�r.h��2>H���UM��������]T-̘��ܞ1�A��Wy-l@@�2�UD �)]+�`>RO�P*��~���M���0��Xr=y��4YAi��EIn����lq�dq��s&`^�V.O 1���Ƌ��5k�6q�+�������Qlm0��D09�����P�yv�����uB%�ݤ����G|')��L҇ػ獣��������Ab�@��.���8�V��]���;���oY��Z'�8�UP/��}Qr|��z�VNg�^kaeN�n�S��z Bpc�z��5�шj��mktm�P!/��:84��ꊸ;�<������s"��{5ld ;�̾��Aj8Z�<�yk�lK0�1�\����S�H�U xY1��%Y��cլOqo�@.�L�t�o��~M̾����w�V\9�tIg|P���J�=�)�\��u��'U.��էU#�� .= � 6`�zF<�� ����F��ϧR�Q�a1��s3i%���ìGc�Ǯg���b^�Ͱ�4�ei��B�'`�j�����T>\�5��er{��/K����������1���\�e ��.9#b�=�n�$�W@�(�{�1��7}ʟ�f����c���fu�(V��1t�?K*���1����¶�:Wj֪��E`�k���Ֆ<�w<)��P�$,�+���x�Zre�m�\�YЃ�Z#���~���UMg/G�솽7f�`�Sހ=��������4sqy������¾:��P��Tj�m���b�7���Ϣv�'N�L� �N�p{A�$~ίWG)F���9bP�9�V D���h�Fk�a�GCh:L��]�p�,���^���8�c��2/X0�Pfh`�}�t1���_i][}�~-�L�_��q���K��$vr3i���L�t��3��5��8�� ��� ���U��k8n 2Ŋ��"�����P%6���l���@�:FV����n�}�c���MV�C��Z��Aа���(���>{�~�~��U�t� �5_!�z�x���z"�ҟ��PhD4�!��y���u�V�b�N �IT}���4�TAM��))�FN��j4�wW1%�����f,�:���6���B��h94�#��'Z�e$O�@��+��^I��7��:�!�|P��Ȁy=�{G�C4���w��ߦS"zf�NC$�}�o��b�dH^%�����*ύ���kwP�}����7�����[ �U�?Ofq��k\��tP�}n,O|��'��QD,5��/�9 y��,��zH�ls�������#j�S�{L�wh0��������f�z��5��#%�Qx��&���Z�S&��?h|Jw�O#�T���L�*������D�k�������[��7��-=n���m� �����V�:[��C*�&�"L�����j��i��ůw��n���� �����*��ۢV���S�.|���>�Z>��X�~�S��q��U�$ʨ��OJg�x��?�YF�MDZ���t�2 1���F��N�Ս�P i�*�Q��B/���a!}OI�*�=�����䥲��2��(K4&� �?�?/mNw]��4fkI{ �|������s<�Ѐ�܈��> B"�ym��^s�"]t��`8�\,k9�ఇ34 ��K��X��'4~��с�8� Z�C��M|S���?ѹ�c[{$ l��|a���(v�N\�Z�k��Dw�"����ׄ~oeJI��[dz�zY=�C nt�TÛ���pg���P=�g�c�`.��h�-�I�\�j��c|)�������^v�:���Č��븶:b�??�T��qU� �j�x$مk�+���6�k���k��L����'d;�[y/[�]NQ�^�/�v� 8��_�c�����?�c5���k�K��w������$��yE��w]�0�
Sections
.text Size: - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 110KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 188KB - Virtual size: 187KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 292B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Как запускать.txt
-
Код активации.txt