{�ژ�r�C�0�n�}$��gd�~uW&�~�15��@��K��f���`j��C`#FglF����r����q���'���an�4F��R�(q��<I��5<]y��)�諿t���u�jR��<~Q�l�W�s�X�3��XJ =����c[���d2�{%�%���@��K��l]D���|�;,|��(!��Tj�ҋ����q�ީ"����kB(ۮ��pdAӌEr�ގ�$%0��p�?���� ��Ī!�sG��ʡ��@����,�h}?�Pys���Բ0�DWO �YE��^���kU�ؘ��d�\��V��s��R˝��`5�1-��y|���ϧq��(?ޢ�_I�U^��ʜ�z!S3���@�`���xQ{p]fz�{���WY��-�Y#� [o����;ď�"Q`�e� BiϓB��l!5|�.���aYӺ瞀��|�f�>Q������ɆG*4�4�؎Z���i��KkLJb�1l�ɰ�c�!�<l+��8�~��n��%�H�(�����3[/�j� �^k������/(���뜄�v׃��-�<�ZJ�0�~c��Mkp^FL��������؟Xg����a��h��{��r,n��œr��S#�g��1��k?` ��i�R��{^�ygb���1IH}���. &�O�CR���&�_b����A��6�~Y 2:���]S�}q�w�u����·��sh�܋5~S�Ak�������@ m�� ��pv����H��?=$D�:�@��Z��%;;��*�Kx��ێ�.�͇g|���W���F ��m�˶��:��1C����j�jD��E�GEG+��@�����+Q|�sf0-ۀo�lw�:��*�aT���ֈ���:�y���md�z@�mw���d�x�m�9C��tY�ߛo���H(Y�|/�ϸ �'G-�VY�nJ�� �� ��G�ɪ��\�f8�l�F��nn���^���M����^��v�(t�t���ǖ�D`��/[�E�>ͫm�V�����G>����������W�=���;^�6�Ir��s6a|l s���y�r]�!D�vp�vV�j��4� �����g�����2͊�`KeUq�8n��%sI�����4y�{,�BF�p)����9A��l�8�Wai�ް��d��d��%tl��������s_(T��C;�ʣA"�-�|��9�J�ͭd~J��p��j��©����H5��7��@҆g�R�{��_�8J柪��'4}�f��ʅ�v�/ ı-䵧Ǩg�ui� ���B�FLH��H��:�����?*����չ��.��bL^^���)�^����Q▯�����h�~�5�ճЁ�"b�z�O��H���x*��`n�c�m�T��7�#b���[���ކ��Mߖ�����ͦr��T0����Hm�<�� ��V� ڿf���uՊ'LJ�+���4p�7�b^ó�'��Tf���Bv���ﮫN>!:5��k-���Z�~�:i/w�h����I���F��PĦ�[�@|{��b�^%�,��'� Ƒ�aA�����C:+("��s��������Hh;�����B�З�����[��BT�����rP��Y%��ַ���k�� �^��-���K-�|4#�(�}�?Ng���w��ё㾷2.�ZP���� +�;2��i��To�1��ԡ�aً�rD#���7o�-!�~��ר�T���ϛuYi��$�Blv{���4ٝA���1骹4�p���yƐ6���4M}2��48zt1�זӥ�#�r7<+��.��%0fp��\W�;����}/x��п�3b�$��'"v��q$����Z�7�ˊ� �"7�Z�5�mT�/�M�A���3�������.E�K�-�t����m�0��a�DUiG:�r=�+��N ��Mq��`ɂ0��M.���������� =���ocr���N; dG�Px��Ζ������|1gAꖃ���+r\sW�8��f�iQ�w�'�A��3ri��01�M1$3y�٨t"�(^�� A2��hIId����h���֢U� ��T^)����1k����b%~lt+�*ɪ*�^R����&���o/��F����H]n�D\(;gѫ����T��Q�Q4���5��B�S��ÀO��NAH�lh�oZ���Ql�6�E����W��ɵU%!kq;ȏ7!����g?�r4�B��b�,6gB��̓D��\�:�������-Iav�H��{b�����"}P� z�R��֦|��jU�Zd��B3����[���?�l>����ˉ�u���Ci���ެ��-U�LZR�E�We��5�5�����gC�=�q���G|�Y��p������yA�q�b} |�SD;�t᧻�V�o�k��ʼnC�������q�\}<�k�ѫ���P�&9T a�F�Z�p�#��_ea��{땻�����@-�A�]d��r���:�!�.���)J���F;��!Mߠd��J���>�*D�V�w}r��Jv�F�C�O��QgF�כ�Y�H,O�s���!&�r�ל�Q�l:�B�+k�_JL�#Wa���W�����V��EZ8ݶ�ku(Si���w��)>S�W@X�tE����O��6?����E���9z]��LW��kU`�TV���A��j+�9m��D݃���`�͡���'n�)9�t;���}j]����PQd�8�'E��L��:��7i*����j�p���t��x��y� m�6]����)YrRa�^���Y��P�{TQ�V��3�e�Vbj��;q�T�v�Kn��Y�e���/��椿����Q�]�M�U��\ǹn���R���._�C�Z�1�;�G�>�O�����R��"��u��ȫ�L�NPSa�co�6�j���i��p�e� �� ��TB��|p�J�}� R��Y�T ^g'g�5ਬX�SS�ֽ\���_Y z5�n�}�r�WI\Ƽ�w�ߨ����DtEA����_�T(;�{��\D�7"�+쯦�C&���1o��D�����w��^�W=���o�喆MG�Ï�9�6Ӳ
Static task
static1
Behavioral task
behavioral1
Sample
FCry3_BD+16Tr-LNG_v1.0_dx11.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
FCry3_BD+16Tr-LNG_v1.0_dx11.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
FCry3_BD+16Tr-LNG_v1.0_dx9.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
FCry3_BD+16Tr-LNG_v1.0_dx9.exe
Resource
win10v2004-20240319-en
Behavioral task
behavioral5
Sample
游戏专题_游侠网(www.ali213.net).url
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
游戏专题_游侠网(www.ali213.net).url
Resource
win10v2004-20240226-en
General
-
Target
06c7e1ec1a08d822fcafca4a92f3cc05_JaffaCakes118
-
Size
3.8MB
-
MD5
06c7e1ec1a08d822fcafca4a92f3cc05
-
SHA1
108648484ac07f0ed296743370d8c32a920266ac
-
SHA256
aa484f85f6af785b07182269241501050a933f6c0b17970423dc61bea7aed80c
-
SHA512
06c4494435151a773b2403d47d7f0b87a0b97c82b2bda1a277b5a587d352700c5d5cca978f75396f5eec7c72d688e110cc46d904c9f185fc7eb3e5404f8151e5
-
SSDEEP
98304:+6fk0+nIXBCGMAhXX5WpuOVsm4ERuJ5gVfiqn3WnwkohR7XkiuZc:+6fk06IsR+XJWpuOVsm4EYqVPnhkohRN
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/FCry3_BD+16Tr-LNG_v1.0_dx11.exe unpack001/FCry3_BD+16Tr-LNG_v1.0_dx9.exe
Files
-
06c7e1ec1a08d822fcafca4a92f3cc05_JaffaCakes118.rar
-
FCry3_BD+16Tr-LNG_v1.0_dx11.exe.exe windows:4 windows x86 arch:x86
2df4a3713f222a98881387782101ec0c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord600
kernel32
CreateThread
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutPrepareHeader
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 927KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
FCry3_BD+16Tr-LNG_v1.0_dx9.exe.exe windows:4 windows x86 arch:x86
234c4ea72a7be47dbb4bddcbbb738ca7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaObjSetAddref
kernel32
FindResourceA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutGetPosition
user32
MessageBoxA
Exports
Exports
ޟ��;S��X<'ۥSL���§/�0�*/i�>Ň�>>�G�Qx�`&Z�B��@F�v��ŝ�%����@����͕N�����TT��f�iP�R����Y� `&���IL���~�ފt� B�,DN��t���$���Bp��o��ƕ�o�.������2L��;^���'��ϡ����V�)�����&tb;�����BR���8�VRZ����1mAbZAv��F�o4��d%]��JAꖿ���{��L<3*�m�/�bM�z�n�K��1������o�$7�;�jX� ��?��>�u�.e�{ץsc�[X�r-�N�����i���Rɨ2z�wb��>p�|(X>p���� ��7�h�C������������R�����G�ʵ\�[h}�� ���{��h��_[�C�u�`�k��S��S�V����dzws}�}��LJ8O�Am�lF���Aٱ�H�{Q�J��b��D���f>�|�<,2�9-�2�[����+?>�7�P*��O���a@�tA���{� d��Oa�������d��̍X��E?�PN�O�k� �?O�j�����|�hxd3 ��Q�Ve�����,[跄C�8 ���}'D��H�X��z�yB�ǔѡ�d��1 ��XD��B�.2�Z�Ͷ��<�џ��d���0m��I{��Í]�s���0�I9�m�5��f�gE�~`D���?M|��������M�B���9aT�X�eO5C��v��'��^�_��<iWMZ�����b~RL(�d��,ͲV҅e0(�~B���`Y�N�a�������kS.���q�q ��2���M>+)};��-����{"+�N�s���Ⅴ��rR�ɋ�g��`Ǭґv*��ʑ��VS��c�V���c�"T�"�D*iT�-;�=L�^�L j�^W�r6��kh���j���ù��Hw�wk�o'HA�)e0����G��6Զ.Lzs�wn����6�2���b��i:p�5i�S&8�U�ty�ȩu��c�v�#��ǒ�w"�V҇B>�c�p@����O���m?> �E�^�b/i��c�+֞ ��Si_���yE��t�b��ҟ��2Ȩ �vJYg0�b�6ک?�v�Q�����,����ċO��{A�8�dN7N��c#���%I��7�f�Z���v�Ÿ֨%��*2r�n�8B�Ȏ�����M���~��g!|&u'> �#��nG?�I,Vv� �t�n�:n���v���H��,i4� �ive����{��g���f1��'f&j|i�b@��(Զ��.�.��=B�`�px��Q���.C�(�DŠ��uwH`Y"i���!Ũ�hP�R��A�0���A����X�-e�ڶ`G]�iC 8���uPR��&���EC����]�=�Q���uG������4)䖟\�jyi��������ϗ��x10��0JX�S� څ�\���fƘ����CP5��w��ä�K�D5pIYŌ��9�o2�G�^D�#���B����������$�PK�,��é��`������3��'ab>���o��T6{�is� Ͻ�6RTr\�� b���y:�'��d%*���Wٺ&���i��٪:eV�Z��2�b������%nF��Cf.�D��4��K4�����'i�ú�Iwo����lG��)��d��T��]��-7aD[Ȏdz�t �T~�^)�ί���'a�b�����:�fD��#k4e�&�:�о�5ju��|Q��А���M���B�l���� �2`H#�������2|���Vh����D�^��jԹH~�#��J���y����I�H�SN��fi2�LB��1�zs}.��`�wn#F� :a��0C�$Ѽ2M��f��� ��*������_�+ \��Rp�٫����Iz�aP�!�b�nH*a�wiͩݿ�WV#R�_���J2dx6a���)�X_��V�x������b���7|9O��̂Y�R�24G掱Qs;��g�~ l��n�s C����v�ܿ�*ѭ��s�B���}��^4;l��B��k���<�?ӑE�U�������]u˽��9ߐ/Ț����`b�[�7�>~�abo���/��� (�2��"���J�\��2YzY�~�2���k#���v�Ր�y��4���W��8Hp9�g~0���\������,ړ����Q�:���|j o�M ��.Γ���C�*�/�ķ�v&&�m�ONH�LG]r����)�}�{/ (�%��d pA�N��W����z�}:�J��yF6R�݃�i'J)fO2��h�l� {O�3klj�G):��?v�H�*UP���su�Z>1��"54XI��� ���r��v��<��;вm�=��_��Ui90�76"�"�0�B?G�i�z�+y͈���-~D����M��!b��/�"K�`�����ŗ�ぁ����pkаo~����`�x��X�U�4�Q>*l�e�2�ɐdeJrS��@i�+������ɿ�w�j��|ǂ�1������D��v�~Pr!��l$�d�+��t��A{���,���OA��[<>�&�M0�6���R"t��8Pi3�����=*�������5�ƛ�s�_�+�� L[�Q �G �<p�S�n]�6@���5u�l��&$Pt�RX�T#.[��0�bp�-#�m��q�A��$WW������ ��Mk'���*ǤZO�}� - A���F���G��\^��퍀�����䄩w���|�*��n�bIj�n�Pu�:��3��לvH�U\_U&kpϧ���S�ʝ;i�� ș�'|E�oEp��Bu�����.�� �E�Hwߟ��~&�q�8����s�^�[��0 ���0=Zn?�HL���]�$���)�24��j�T�^a���kk�6���=D3���ƒ����PJ�}�1Ɓ�)�P̋!���Ι�]��$1_��8S���jD���7�`-�&�ڹ���C��&y�Ĕ��"�x���8�z�&Y+�JB�`W����cDA� z����Ӄ�N`PΏ̈́�rH�.�c���i-w��
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 927KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
使用方法 .txt
-
游戏专题_游侠网(www.ali213.net).url