�� ��ܹn/�]?H���V��.!A�&�� @\�@�~4%V�.MyӰ}�A�����^:�����$�|8B�o�kpHf�r��PE�X�_���1��ip*�\P,w�!U��l��Z�[�+��©�y��1Up��ZE86����,>ő��E�m�˗)����O����p���fM6�WF���$C,���C6h"X���5�Uӆ*�� 2��4;��ј�H<��D�2[�u�E�2=���|O�z��*�7˒\We �6U�d�+���Ϧ�TSG���嬅�Mb�ޠ�K���fɣ5�3K(�]+T�J�W��eפ�����@VN�[�^����)���ֻ�l�������"����F�z6��2M�ZB�"��9�N����Y��Նe8��9�l[�''(�y�ICکV 4�U7W�{��ȴ1��<^'y����yx��8L[��w7w����j���D�r�T�������W����)����0���a@��M��[�Ǹ:��N���%�ɞ�T^G�je�@cҚ���@���N��c���,Cd뚠T�;$M#y� �Xm0I�+��UDg����9 ���(�滚.Ƌ�ʢ���f�����k%������H�u�Ҧ웑:~NyL��ο���;���&Sw�-{�{|�ҫ�՚���i�|�coU@��(��1�k�[S')�e�XTD�2�)�����b+O��~ږF�g�<H��UfHg�3N��;�]گݴ�//��� O/hj5S�sW!J-���V�DO"���ݵ.f�tK%JE��m!�֭]i��v��-�y˩T]�+A<]�z���-O���B9c�K� ^_��VG���N�.������з�w͓Iz�9BG���k#�*,J>���$%&n���q帔b���Q~� +�|E�e����O�B��P�,��k��(����+�[_�?7� ۥw�A�g{=�P�;�x���D��E5~�~�g��=�yS�4E���c�jP�[�;�FN�kڷ ?��lh�&M��{;T.�Q�;%|:�^ �gx8d��^�cp����W�עS��k� ��\%{�ۊզ��7gU��p���Q}TkU}�9��� ����<�6��#���I �s���TL���jȝ 0G��SҞ�>�����/�9p���ݎH�?�Hf��=AX��`��Ӥ�Βc�=-�L�PjП��+�Ɯ�$M��SF��ɸ�����m�L7ѾPv�S��6T0�N��Q�ք��>���~$�7e�!`�Ǡng��y�t��Ϥ�}m�JBީ�7_�k�u_N�IL;�`G7Lb �;� +���B�PF̈́�����6���*��sC �v�4�k�Q\t��9v(�z@d?�/���B�Ʀ�K��s�/�)L���}Y4�9Gj��< *�5�|Bfά�-��)T$����l�c��i_��cH)��e��F+kYq'�;_��9�s���t> ]�Ʋ�)�M��[��\ ���_k�Tf�I}����<C��pRf$'P��-��/�-%��'�ha��a`d�0�>Kh�2mF��=�\$�����9��M��t1 B��b��m� e$�䨞(�6Kaà �P�յ!0FR�4�۲Ac}q���? ��t#��[���� ������i���z;��dg`��A<��^G�Ej?�,��Uވ�f� ��f>Mo�Du�*Пw�ߝK�����@y�����c5D�@������D�����a���Bσ�;�㷗gt~ے1����3�A9j52��F�N�t����DJoJ�� �bg��X5L�j����Ԛ�.�r��j�T�E�TA�[&,�b��Q�����'���%Uu�{�nx5�����ԕ��k[H�%4��2;C�^��t�xld�A@�;��-�<�ܩU��.~G���JS���l%�]o���ĸυ�)�.ez�����5aY��9U���"q���ʌ ��%5� xƱ�i��ς1:�T��Q���ެZ�4�jG����C�E��_EJј��j���x _t v���>��kW�]<e��*�¼���U�������4o�1��$c̠[�uLKE$�䑩/�@L�����:�|@�M)�m���q��qe�3�*�C�O`����tt�"� ���>��qq�E���������Ä'����F�M?���2���D"�T���#���`�S���B�$1u��H��l/(E�: �jV �4�������8���v<]*����<�p���9�d���X��_��0B�X�G���ݎ�ԃ����%yp�G�6�!-3똱�y��J�&��T�bJ�%74�ST�:2��$3^8�g{�����=�_˂h�K)V+��>���G�E��.<��y[1�m�п����S:�s�CG}p�zs}���Y�xl���9OJM��^-�.RT�'�r1���G:+cD�־��lh��_ɥ�ǟ����/F�M e��w��}f?��Gl�����q�`m%���p I�\�"!���s2�̣�}�ä�����6 )����fʨt��VmB���g����,�� ��~���h�|Y��s����o�_�-㬻�Q��������'5 !`�Ҿ�"F���T�J�ڞ�M;��7�c����:,q���A�<�S�ff$��6�HGg �D �\�����G��2�wrG�?`K.YK�dժ�s���)��s(pt�j��PS�e7{�JK�������sHh���@���b��O@�Xq�aWtK�W�ϧ�&�"���F��D�=������ȏ����E�~R�{�ƣ��b��P��`��+�ڹ*������1$����)��; K~ݴ�aL3*T�쪟�͒�.�^��_�j�EňX�uϼ��жu�4���6{�29��"��,��R����Є�D�v,���/��u��V�! �� � �$4�.k������L�4�R�co��ԟk:��5;A1d�p/?��ϵ��{ìfw_��*�b�2?�U� ^���&Y�P�^�T��D�)�b�Q�'YxV�sSG�6\ Wd\x*Ig�E_~����4
Static task
static1
Behavioral task
behavioral1
Sample
《战地3》Update 6修改器/BF3+12Tr-LNG.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
《战地3》Update 6修改器/BF3+12Tr-LNG.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
《战地3》Update 6修改器/游侠网专题导航-游侠网中国单机游戏门户.url
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
《战地3》Update 6修改器/游侠网专题导航-游侠网中国单机游戏门户.url
Resource
win10v2004-20240412-en
General
-
Target
fd1e97435302212691042af256a31f19_JaffaCakes118
-
Size
3.4MB
-
MD5
fd1e97435302212691042af256a31f19
-
SHA1
9d7bafedc7e98fa917f49349c9d6663a78a1236f
-
SHA256
30b90170b6c8fa8e41fe5ccc92ec6e2050e630847779f45f22f64476903e5a5b
-
SHA512
82edd83ef1a9bb8642fd9142f10a1f08910da4095c8c65e16992d3776347db97b7f7090fbc05f1c1953ffdc5becb16180db19e1b5612da9def1abdcafa0252d5
-
SSDEEP
98304:RqNxWHioSasSsc+IVs53hlEkv7GAvpFs9L3OwSJWN:cxWCHREs9hl7GqpFyLOwSJo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/《战地3》Update 6修改器/BF3+12Tr-LNG.exe
Files
-
fd1e97435302212691042af256a31f19_JaffaCakes118.rar
-
《战地3》Update 6修改器/ALI213.txt
-
《战地3》Update 6修改器/BF3+12Tr-LNG - I.N.F.Os.txt
-
《战地3》Update 6修改器/BF3+12Tr-LNG.exe.exe windows:4 windows x86 arch:x86
10d0bee036b5af10c1c62aa911566936
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaAryVarVarg
kernel32
CreateFileA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutReset
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 952KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
VCrypt0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
VCrypt1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
《战地3》Update 6修改器/VERY IMPORTANT!.txt
-
《战地3》Update 6修改器/游侠网专题导航-游侠网中国单机游戏门户.url.url
-
《战地3》Update 8修改器/ALI213.txt
-
《战地3》Update 8修改器/BF3+12Tr-LNG - I.N.F.Os.txt