��m��G�[mC�ё�I?�׀G��Kq;Ǫ��H�B[.A��V� ӂ���Fg�R�ᴅ���P�eC�`�{�PkQ���f'���c���o������&���B�9��x��L����V�L�Ǎ��*J�KR�3È�{C&ؘ�̱��P��j�_��i1|�M>O0��x�Y��|_����)�f���}�,H�w�гهl��~6�wR���0��9�U�1hG0N[_��C��R���+�N����\'U1�_�]]05��I�l���|�u����F���Wql��X#W�� \`U���5� d�/ي��A�)~�dWRl{6@GC#v���c�ZwnXV<#�4}P��� �>b0��B���ffǟ3x�����W�=1b���߱.� ���LFF���/"��� ��F�ީ���Ti�_blHV��k�><�*����S���ա*��*+nyC��'�,�f2=Ϋ��^!':AJVhZH>�ѝ�����2%��g#Ǵn����A�?�9��-���:]\H0IgAe��)W�@�\�A���m��Q�Z��rP����=��M)���$�����c��-�ŧ���z����'-��{Z��<��<�p;-P�ᓟ�J'���1�o78��Q���/��.�8��=$�,�۵ܿ//ۮ�y�0R���K��=�����B���x���c6�V�������s�.�R�Y[�P�8�%�_J�{�\�"�`���|x���U�L���5L�~)��S����l�rjK�6���j�F<�{�F���Cs�&��b@�pY���u닝T�Q��������Õ���A��b�o���|����K�|�PT�t<Ŷ�V8ҽ~�Y����f�����C����>F�'L�5M�d�S����a.K�P�У�'��{��#;�* �E��ؒh����UC���'�G�y�Oy�Q��Ƴ��ҳ�Tǘ�S�b�aT����d����5�������F����D ���Uk�HkȊfY�h�w���<�(�*�%<u��� ɞ)��3�*�Q�B�~� ��&S�uꬂ%�-fBTnF4�yu!R�!�����PDz��_0�}<�����Ǎ�! �Ӓ��c�R���,�����z����\�Ɯ����&�.�q&��zߵ�WI�|^��ibA���VQ�,�ƻ9�������2���J��w!뻋�QV����]5����jn��Z6�S?ښqEn+���DF.�qad/q池�gZ�I������`���ޒ#GQmڼL#|ܨJ�H'�>Yӟu�ZXl�p� �٨F贇���'�a�3���'0�Ckc�a(�]5}F�t�Xb_��F�.r��q͘��)݄��C;/Q{%�3ݮ\�����1��T���q�{4GDU�MΔ�:ƣ�H�H z8 1v�l5ǰKL�?���H nKT�BXz�U�T�����)Y��#N�|����|�`�g���1D���{ؽ����=Z��9�����&�C�����l�CncCJ�E���M�7Գ�/���G/.62��.a#�}� �e��s��J.;�%r���h>� ��������;�@<�y\��)6��Q|e%�t)(q����A��K�:X��c�º��|OO�ʟ�׳��v(̹�*WVS�}ˡ������� ��Ih�QG"��[ܸ�3[=1z��(F�����%���=�3��3;썇��1A\H6��%u���hZ����V^ĥʈ����i�Q�*� WGz�~&��$��[ޛD�@�/���yH�FT]���J��(_v�y�������-E\m;�8:���8�TjNS���:��-�������1"���u�� *�5Z�-W-�=�� �?t�雍�s1��>���Kk��@"�5��#�۬ۆ���{F�g'��yE��,��c`�7�n�����K*߫e��^Ƥ:W���2&�V��x*�"7��g�O=(h��ST�\�B���7�=S���7P�����#S��n����`�y~NP�y�^����I���&t��5�843��j�G�Mq��]��}U�B",%��!"�3 QH,b����^�w0)�ATrb��-LQ#��ؘ<�uc���'�8L�Ej�J�Q�l}UH���5-���d� �ݷ�?�����r�����H��Ŕ��=��+0��p6�縡S��v A��~�0���^F�COk��)�߅�,��z��+�$���g��A西6 �`���U�����KE�.�(�@C3V���wYK3F��f�>�?����;܉��IR�Z4��6�pެFMF_������_�8/�,d,z�:f��"[X�Y�l�IR���Us���3_�/�|/�B�����t���vN}`z�����F����g�������ֻ&�ڈĤ��wJ��<V�1N����-mbo��-����n�����Ɋvɳb@m�? �z܂���W(^���h\����UdϩG��hq�-(E�c�#�iRa.r�p�ݖ*[/}�o}-^,�gZˀ�ȿ���+��,ʹ��<������'W���>�x���+�&v���P�g�T7�ve��=6j� 8Z����ҹX:H�P8��5���'}`�*�ŸY��B�W+��$���Y��Z`_q�e*�H��hGs�����#e��Β����HƖ܌�)��K�'���y��ى�5������:n�S1~��S�3/�X f1�v��MO�>����+�����#4&�t���?�.��>��|�����V�Zɕpu���A�6��P����K��Dt 4�D�q>��-l8�k�ZnU��:��!��oӤQ��m] ����Jx]���]�����z�zB�x/ �=���\;��1��$ՍJ)���t)��`��lNs�V��D߫6gV�SU����>��)EC�=��i�3M\�*�0f4�^�)` t��9��/p������j��g�|a*研��V#����Ā-�wB�N���ŬDh�<����n��Cp�p�)z7�}�� ��� �$E�wv��t_�B ���Au�j�Æ��tu/��_��Ŝ3j$[Lk��}5r��f�MQӟ��?M���Ͼ�p�4�qn��N
Static task
static1
Behavioral task
behavioral1
Sample
CabelsBigGameHunter2014+4Tr-LNG_v1.0/CBigGameHunter2014+4Tr-LNG_v1.0.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
CabelsBigGameHunter2014+4Tr-LNG_v1.0/CBigGameHunter2014+4Tr-LNG_v1.0.exe
Resource
win10v2004-20221111-en
General
-
Target
21460928ca36cd1ef6768676cd8924feaca1d5c7c4ab900870a982a89052468a
-
Size
2.6MB
-
MD5
8a274b0179ee85c696a9de761b0b4d3b
-
SHA1
d3cdce378b83730d55df09a3587e1769869c5938
-
SHA256
21460928ca36cd1ef6768676cd8924feaca1d5c7c4ab900870a982a89052468a
-
SHA512
ed3bd99c0dd192924f2888a0053dd7312c8e9c38ba11980226d1ca11fe491a858fe3a827934eaba6e4c53b551aa950ba0e11922f590550fe68bf7fb7de49c8ab
-
SSDEEP
49152:6s7V2nfamZpXmvbtPelNr2+cpm4Fbsbonsv9bL4DOh+ECza7ErnvO:b7YnfaiAhPelNC+cA4FYv1XXg/vO
Malware Config
Signatures
Files
-
21460928ca36cd1ef6768676cd8924feaca1d5c7c4ab900870a982a89052468a.rar
-
Cabela Big Game Hunter Pro Hunts трейнер +4 v1.0 {LinGon}/CabelsBigGameHunter2014+4Tr-LNG_v1.0.rar.rar
-
CabelsBigGameHunter2014+4Tr-LNG_v1.0/CBigGameHunter2014+4Tr-LNG_v1.0 - I.N.F.O.txt
-
CabelsBigGameHunter2014+4Tr-LNG_v1.0/CBigGameHunter2014+4Tr-LNG_v1.0.exe.exe windows x86
944ebafa06cad86f735cfb2759a92f32
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaCastObj
kernel32
CompareFileTime
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutOpen
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt0 Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
CabelsBigGameHunter2014+4Tr-LNG_v1.0/VERY IMPORTANT!.txt