��F�)�7���Ӄ���ڥ���_�]�s}�D���zn)�$X#Mh���;�5��y���!�OP����� }�1_f�/��tn�z�w�C^���:��I �mh�i�]��dj�Q��X��E�Z.�v�(/O#2����7�6��P������ ݟ@}�n$�t��ۢ�������םH���:ެ|��'��:��v~\w� ��]��-�R*��^�v���/L����z}�{�ƚ�↊�Y�A��L�ڞ��J3������9�yr�<�"�H�U��9�#̻�kd$i`?��m0��W���T�!��<A@1��3^��"�J����)��mp��RdB���O]�韺�����.��T��Vj��l������D:+{C�x�t�C�|[�ϛ��3��X��C��RͶh�]˰��7��]��Up"�9�UN�Z�T��b��7������Ծ%Տ���b� #�����m�x^�\.�wJ�%s�F��e2����X�� VG��j�:H�I�Q�RA��r�]��L/���ܺIA��),Jd�#�vwG�����*L�G:�z��G�7�}�O%���S�ulg�����V�ܔ'�p1��X�5�]D����h�ZC��>W���N٢�� cp�>�=�n�� ����������^"�i�NZj��^Kc�z�ض�b��s��H)��~f�ǖHO�!�S���W���YO����1~Q�������|M]�����+��_�F�����*�?P���L��j �H��~�����梽����z�>ܣβ�DpI&`� ��5B3)s͌�RƐ������6αT�������) 4���#Ѐ�Ӽ��:v�8X�}_��-o�nx��JѣO"d�J��?O�n�������ow��G���/݉1皂��vH� ��#��Mu�e�|���(0��Y$g�_����Q���{FO�h�y�~��� 7ό���.�a6J�ŗ�oէ��7��о�"���f{S�n�b|�/�n���伾 ���\���ȯ�N7�]J�uus�d+�`��t���5$!u�&"�ϕ��J�i�c�6u7E�o��&�N>RV�Q'�g�ze��dm#��c�}q��L��v�4"9�ai�Ȃ��B� ��,�g��G�B��F��`c?�e�CP������ŅB��v�男�Z�2�l��A�j H�WdZi�v%���!-<���y;y'� v�� �$�^Oh��j�*���hX>{�x�=^������D#S��g����H���)��Rn[��~��l�U�V��<�!��!�"��u����z�d��HE��n� bp���Ќ(;ީ'��.�!����̧���}l�v��!� ��u��������|���~��Fvtc�%f2�V]F0��LK!��/�2v/�^�9DŽ��9/I�҆��7b���3���ilȔ9�h���g[��UrշN�P5§ns�G��\#�J�enݑ��y �NW���%��:��[ͯ{�O.�4t����,%��H�AZ�}���۷�����UX�5���4 �d�f�sQ�'I��t1H��Y��:\L��P�%�\��ϻ������v�E��˘6L>t[v9_M��B���v���d��5V�f���+��8�gΒI\���] �,0g�:���{5[U8��DEV���lf�_�>T��:�Lq!<69�T���N">Qe�-��#-�B_&���u�i&@;�L�]膚�~\��_V]�������V��t�LuI����{kp9�`L�t�1���1?���\��_�E����X+��Z�Z�y��������<5h�o"����;d�������'\k��oEXÊ�>#��_�;�m꽒�D�{Wa�X�>_�e�<��A(�[�f�Ͳ+ i���)F�e�T;t�^�& @��`䁢�[�6���#y���p��Q:��}�ix�� Yy+�ϲ뺧���O}|�`z˛�Gf"���^���� ��.`�|a1:B��P2���;쾈�]ů�̓~Q�A��&X1��8�����t�,3C@ ^�?���OL���`eAk ��� �^�����l�."R�ժw�)��X�}ndi1b����f��x6�Yi,:fH����+�1�Qr|xk�=0��b�`� ̀�n�"������0�+�f�����`,r �;Kt�\2q���5�@��w^$�x%�� tF���͆�m3/���y�xx3��M������Z��,�.G��s�m�Z�>Aʩ�.y�l�E�:/�M�#����/Q�`"��c��&�?x_�J9��Q����C<�u��� ���S�E$ʀ !H�4���>��Xq1�Kǁ+��&\�U[�*Q�_���F5d@B���Ӓ�똉��~f -l�<��Lj�G�K�h�CJJԎ��M�<��W�QmɌ�x���n��l�����U#^V0�R���˯�ab�K�2XN�t`�AqI"�Nr�_!No�nɶ����%��� �K�dɓ����7�����W���G~����$�C���̧��k ��ۤ��赘����t���'��WqB��e���]�aO�69���װ}��C?* �?���فH�Oh/�N83�7_mYעf����� 2�����<��t!��{��6����<Ǯf�3m �H�*�� _}?t��ǩk�9�$!ȩE�����1���.D^��x�<&����|�%cz�o�k?^\�� �Ne���@��?,���E";��!����ڵi"in6�+��� ��`N�ژ7*��ܢ�LhϜ��Wz_���q����Q"l�g�X~�+��Ma��$�%`�-��� �r���[Kc��ڗ�������"�>Ձs�g`Z%y�7p����k� (P����v�= 6��u5��B�q&��Ӄ�*��=%�/`C�V!U1݃q�b@3���/�aas��ym\���T���-,v�8�́K! )�B:r��� �W쪍�$�y��ϡ�U���g�Z&š�nCrS���P?�1��<�P�%OV��,v��:�����]�7�!�gq�oĨ��%���M������t�֙���+I�8�
Static task
static1
Behavioral task
behavioral1
Sample
Assassin's Creed Revelations-Full trainer-{WWW.BOXGAME.IR}/Assassin's Creed Revelations-Full trainer(11)-{WWW.BOXGAME.IR}.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Assassin's Creed Revelations-Full trainer-{WWW.BOXGAME.IR}/Assassin's Creed Revelations-Full trainer(11)-{WWW.BOXGAME.IR}.exe
Resource
win10v2004-20231222-en
General
-
Target
5183b7b03f666fe57acb4d2ab64d9c29
-
Size
2.2MB
-
MD5
5183b7b03f666fe57acb4d2ab64d9c29
-
SHA1
c843df51bb2236ab234791a8d709e2e391ac0bf0
-
SHA256
01e40748aba45c6195be0ac352b56fc642d0fe2b7932fb7c015b8f1ae36720ee
-
SHA512
3d44093d43fd6673b543911a6e9149a9ae2ae30b2119549cfa46db253d189bdf400bd572529ffbbfbc523529906f969c02c2c8a8cf51f5c7330074ea09599e9d
-
SSDEEP
49152:wzvPkDEZYqS9RzrwCA9ON0nYAZ4ofhWH1/dM/GDzWpzE/lHVld4hYary:wzvfZYPFwCA9XnYACg81/d4GDqpzwljn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Assassin's Creed Revelations-Full trainer-{WWW.BOXGAME.IR}/Assassin's Creed Revelations-Full trainer(11)-{WWW.BOXGAME.IR}.exe
Files
-
5183b7b03f666fe57acb4d2ab64d9c29.zip
-
Assassin's Creed Revelations-Full trainer-{WWW.BOXGAME.IR}/Assassin's Creed Revelations-Full trainer(11)-{WWW.BOXGAME.IR}.exe.exe windows:4 windows x86 arch:x86
9160623b28b2f92e7b096a73e51aff26
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaExceptHandler
kernel32
CreateThread
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutGetPosition
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Assassin's Creed Revelations-Full trainer-{WWW.BOXGAME.IR}/www.boxgame.ir.jpg.jpg