�L�A_�"�բ�^���+|p۠��� ���q��,@y��t?I*鉤^�����e�/�o�q��Lj��0�����X�����������Q�oՊ 'nȕ�"�xҮwYu�p@���/�1��g�o�[�����s���{j�]�:�)G��<��:�v|O{,��F����_)QD$�D�W������QR�,Iq_F�Z��@���v�T#3�w�֪�<'q��G�;]�+�Y����PwƩ����5xss )����a��ϩ8��QYN66�z^�Ʃ��E���$m�GZe������1�D�UC|=��>�Xa\kI�!U�?�Z4�d�bױ���|�Co0JO��e�l�k��N�H��l�H���|.�>�8��/��s]����S�Z�z:���Z5�g�[�Y�[� �A�چP��L�Z��t���L����(sJA;�B�O�!��̃����H�� �����@��f��0�D�`�VH�u=Ji�������<E H�R��1}��s%�F���RtK�j��*X�NE��ba����X4�C�Fٻ� #z�]B\1�-��ܝ�͡��L�TԔp�B�ӘN�6�U�6G�[|Vz��~g���[K<�屺�\QԷ?��w��,��������� �8"��p)d��������\@�]''$t����P8t�v����;3��_ȴ5R��ո(C,��V��C*�q2�&�8ձ[����X��l J�Y �h�jf�V�p��L)e����r}��_���ٟ퐪�*bz��'�Q����\�h��A�ˌǧ�DpM�*��*�]h�Y���cv|N[І���C��>��둼H�!�~$Ǻ,�����v?�q�`�7��T�k���V��$�.���.h�=����ue9��p=��p(?��c�x�T�� ;v�o�ܵ*�Iڲpe-ས������/�ϔg�"Kh���Ⱥ��y�bo���0�%Paz�B!Ky~�C�_5u뼲�/��;B��J_�Cj3Y���ն��g��N�� �[�8J!��lY #Op����敨C���T���o*�<�i%9�u�����Y��kez&,/�۹��KS��C����}]L��u���������&z�k2�Q�ޡ�E(>�����cb��z��gƈ́����$�'}�aSG�o\e������9��*Nt��~X�f��}�+��|��4��}��L��`%S^�l�%]�x�� �9�%�9H�å��\�� T����}u}��nG�j��9��}�A2'ޢ�-錠`9-�=H�z��B:q��%����r����k�+�����3|�q�W�u�O��}$�)~�^�p�[SB'�^�����4�ɀ�t�W��Gj�����֒s$Q�z����>!���]9�2\��e��i^g�SşS��1'~q+L>�j��F�C.Ya�~s@�X�;3N�MESJ�CbȠN q��˾���$�Am a~�G>�kg@O���*v��@?�-o�N?*�s+�K��8�!�6���U �8,�*& P�E���_�=ZQ)yj�$ �6;Ǩe����(��J���G���l��: �w�������E�6���Q$Jvc]c���GW��ˠ���`��T!_��Jt]u[��yc�M$��۞K��]Y�T�?m���䆝���j��]�DʻՑ���"Z�&_.�i��s�qE��Q'UR?�5����*��X?]�g�?�I���I����?^ �S�AJ�mB|(����vnj�\ V*K%���^��v�1�ت9���ao*���c����5zW�sL�#b>U�����z|�-�E�,�<��ӵ�.�_�˻�le�o�`� �8��(CO��l��vsά�W�W���y�^,A�-SdN�]��#��UJ�"5��P����F{X*d�����[�Z��U�B�S]l���J������A/��t�w� �i���t�.��{b��>nо�loR0����@*���B��0^J&�;l���i� ����M���?%~��m$��"�)C�L�5A⟹��ς.�T��<F��/`v���I�$x��0�\��ގ���«���n{A(,�"�~TD��Pr0X2>��<���!���g� BL���]�\��A�jȁ>�2:����R#D'&���,~����Qh=��}�y�\bk����n��00�`�wUJ����/�8�?3�dͲ�t�2 S�a��O� <|�m��l���G�ԓ/2Ӽ/?p* !!E-Ub!�o, �۲�M5�k�R�Z�c�� t�ZX:�����)g��[����G�+|��"���4>�#K����?t6�$qxlE#y�P�t��r�S�� ;y�d��}�0�Y�%"(V�S4�K�`j����!9l~�QmK�#l�n!U?꓄��R[2���z�KQ��e��g�ּ9�x�L��""��s�W�N��qR���!�,Wm�*H��<����v��,C��)�����(TS�]�WZ�w����'~R�s�����zxRM"����:o�`�I����vc�j-~��[�7��5�V�E@c(S���2��g��O�'��ܩw���)�/�T���`4�(L[�� FO�6���]L���������s���d�m�鋂�8���՚��Sv1� ���>�s���a"c7���]���x���G�0H[�3U������(��o)��Dk��Ч��[q����]�l��-�ELv����X> k��/��+��e�^/W������z�rBq�h�Fӊtj�'������ �Yl�s]*��Ϳ�.,X��6�(ӦRDl�o����2�>&��/u�`�g������+E�)_� �����7�����M)n�|���5mGߖE�m�3n��{���i�&���Y��U��I����mS+�WJ�rD��о���4�D���:j��m-ɜA��v�6 $����������)�v�\�')~d�H��`� Z796��cSK&��mm���##��N'G���v=-��n����5\Yq;r�G<m^Hv�.�s;�1�h��o�c�5���T�&eG�Q�����?�/�q��FΧ
Static task
static1
Behavioral task
behavioral1
Sample
R2+5Tr-LNG.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
R2+5Tr-LNG.exe
Resource
win10v2004-20240412-en
General
-
Target
f1eb42b3903621d0bd34417d3a5e9c0e_JaffaCakes118
-
Size
2.0MB
-
MD5
f1eb42b3903621d0bd34417d3a5e9c0e
-
SHA1
000712e8169218ecaf9e4808ad84d79e8fb2c527
-
SHA256
5e1b7d2d3fb4d321224b66a5a53ba78290154136ccec32850b9b4793a66af3a3
-
SHA512
9b950f513e51d04ecb710133958c22d2ce282e8a0a127362348af4b7a14cbdaac13d03032bfb646c166947bc258d0cc95558f90bfa22320e2096b89aa67d3bd2
-
SSDEEP
49152:lnbn5YxM7cRKJFa5KPkQbi9hmkQbq8eX8u90ujWXdYHC95Hm:BaWwOa52SmSTF0CWqD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/R2+5Tr-LNG.exe
Files
-
f1eb42b3903621d0bd34417d3a5e9c0e_JaffaCakes118.zip
-
R2+5Tr-LNG - I.N.F.O.txt
-
R2+5Tr-LNG.exe.exe windows:4 windows x86 arch:x86
670cfd0c7c3b08fc2cd00801bb1ccfe6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord572
kernel32
FindResourceA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutGetPosition
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 951KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
VERY IMPORTANT!.txt