�#����{�c�s�B���@6��` ���W���-�*eq���L��&�=J���#���p0�Z=3xˠ~�x>gމmy�Gn�( F)~�بh��-rWҶu\·ϒ�V 1,������,#⿁��A���˪+Z�l��I�G�\�ٌ�AeR>Z��� G�Խ���R{�,�S�*�*��ĺ��^^.x���E��Z��E�Y$�h��GRfs�$�����P�ҔW��Զ�v��.�D���*7�DB\X���>��e�����Ԇ���bc��������i3� �*f�li�4ϝ�m���d&\a=�A�+��u�5F��ꅛ��O��v�ǒEL�EA��nn����gYH1���b���W�a;j�t-ݰ�!�k/>3�2t�H�^��_@Z� 7`��ꇷX`w�i#;*(�|Bh\� g$4ī�2��QKe���`���A���i4f�K6��T��X1���.� <6B^<��y��%t�V˶�5����5�%�.�ބ?�ߐ!�� t�����]"ؤ_XjJֱ�.��z�������H<�x�z����L?Z%�kvE��J��RQ��@� �Aq���%�G��d�)Aނ�?�p��g�Uj�f�;:b�o5G&hY@W=㋔B-s�ry�yJ�8�W4��Ih��X��.;m-��ScZ�H^Pg �8n�.k�VyP��?O@bP�4��p�֎~a6�+����}�V�e4����d�w�^7��}�9�'u��3L��&�6��6��,+V-��LpA�8���l�q�������L)cO)�_2 /9����[3�����Ll5��"Dg���]7���t�y���-��ίQ)t�e�v���"���k"�8��S��~wn�a,�E�kȣ3� ��9uT��#P�$8Ǭ�ח�F��$�i��g١Y}z���>������z�[����.ڡ��H�t=�4ff�s����� �6Ұox�\� ˇY���}�$2���!�Q�L�'c�+�$Q�~Ԧ�5RngLsBrLA[�]��_K�i=a���Ý� �q(�:[^)�{�K�n��Nj���6 �"�9w�Y� ��9Zo����/�gl��B$CŰ�9~�$����s�su!� ,�IT��r��E��`�V~d���NV�v��M�g�~���>@2MD�l���!��7�8�a��HN�y��~-�ԍ Ã���yQ�@a���HX��j�(k���[FX/!]�G����CIJ����)ɛ��o�,�Y����Vw�+��nd�[bG$��K����a3,��P�"��z�?��~�m~�jR�_(��y�|�n5fs{��d0���^��$�Qdt�4��2����q�S�>�T��T��S�|A�Ŋ�:���k�����o���DP�H�T��=uD��fVjv8mk6�,�ũ7�K"Z�?�=����������$[2���to�\�٫��|��nt���� �*7n�Ȋ�����%�XQ[������Y����3�MQ/k{t������r떿>���ax%�K��'߿��R�J����K�4(4B5p�����Y���!�����i=���*�4���s��؈�u\c��1I������Jn��ⶆ]����<��E��%6��?���ZGh� g ֹ2�Ƹ��Y/�������%{�\�O��Q"<�?S�>L!Itk`&��YK���D����֏�wRr�ȭ6c�$����u71 � ���HV#���:�}��P֟ ��6Tq�`��9���䎅��_~)@5����}@Hp �r�6��s3��;�6?��ҽ^�"6��DQhx3������_H�K��^�)�>ϖ��?:;�6�[���%��r{�1���?]�V����й_��I@+���q���c官>��DGERv,n2��h�5/�К�"# ����_���� �|ެ�S��>\���صY���M�/ 4#>5����b���"�Q;b��� ���"ؠ4m��!��./dƭ|�1�����w8o<��)h|@����i�D� ��4�]��G���hhxUt��~���A�U'�%�"v���s��#��e���ō�J����g��)�H�&�K��ٝ��N:;~������� ��������3MGp2�'���ܶ��ϰ��<bIn7.�&F�^�������s͑ڻ�d+,}�����ʊ ]�l��^ƒ������t�B�9�qr��l��a)bS�G$�G�!�>���ZllĄ�����y��d�G�Bp����kp $Y K����E��]��j��\[���q�$����f\OX����i�l�#��"��b�%V���3�4��I��s���ɍ� �9Qٯ���~/I����-�4�1L�Fi��� ��p�����-��\%������(�"�$IC��#����|n~�������c�Z������\���x��d����ch$�uI���)!&��~5���'��cg�V���<�~��w�8�%��,JV�(G��� �j ��0�E ّ��]��)LΝH� ��*x!DC�"�t8q�Q��jX2f�Q,n �=\��Y{�p�[kJG�^�^䠶�Y�.rc����R��?f���R��/WF�!"V�e����O H����2�\��bhf���{���v�)�O$��Ah�h��aX&a�����=�A���>��kp�k�7ٮaG����sF���g���o��Ȱ!�V�u��Ul�&|��2d/.40��椫>ޯY�>;߅�(GSB/�m߁�i qΜ�������H�e&R��Ƿ!4��L��.��.�wk5^0�����n�h�qAM�\��H�fc[�T�>E�K�WE���4-|���y����<%���*fmt�cI��$O?(��TU��� "�d���駾In�nW��R�B�*��7�9���a>����w���cܻ����NΟ��2��,��HM�����,f��џ����+�"Nm�r�+����gԙ�9=#V��;>�tF��0�,ȴa��&Y-Q�ܵ9����5r���Az"���R[�b<����Xh&��N7���Q���d�
Static task
static1
Behavioral task
behavioral1
Sample
MPayne3+10Tr-LNG_Alt.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
MPayne3+10Tr-LNG_Alt.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
游侠网专题导航-游侠网中国单机游戏门户.url
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
游侠网专题导航-游侠网中国单机游戏门户.url
Resource
win10v2004-20231215-en
General
-
Target
1429b953ced63a079e621d976dfeb926
-
Size
1.9MB
-
MD5
1429b953ced63a079e621d976dfeb926
-
SHA1
a79ef480529832c04c2f22323ebdbffc5d3b4a5d
-
SHA256
d143b7303a04b871dd2c559164f3f051bd1e41632cf52bf5315bb3d3d575da20
-
SHA512
8876b0e2c34c01f1052cb21a91d9ede2ffee9db95154c9129e1dfd87be5bef1cfdf8fc1c83083bc056b55f7eaeed2f5d7bb34711523a70dde47234bb36cb83b7
-
SSDEEP
49152:lqaSkdWuG/30AEIy6rztJXvAlX/RUUlpPdVRgo+ou0Tw4:lYhL30jYn4HZlir4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/MPayne3+10Tr-LNG_Alt.exe
Files
-
1429b953ced63a079e621d976dfeb926.rar
-
ALI213.txt
-
MPayne3+10Tr-LNG_Alt - I.N.F.O.txt
-
MPayne3+10Tr-LNG_Alt.exe.exe windows:4 windows x86 arch:x86
c49c7911e7de2db1e2a31798bcb57bdd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaErase
kernel32
HeapAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutUnprepareHeader
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 954KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
VERY IMPORTANT!.txt
-
游侠网专题导航-游侠网中国单机游戏门户.url.url