� �X�Ζ=�z�����U!���TY){�L��c�^����)n�����8�ܨ.� QT&��>=57��Y_����)N�)�^�����1����4Ȩ��j?2T�)5^.vOC�|:������k{�d�F�K��#[Y豬J��k��ߖ�lB�Z辛>7���c3��2��q5���Q��p���5�ɣ�ۺm�����^n��r9�Ie��t�h��a]9�C*8���QCq|�x\Dg�}�����7�{ �c �eh�C��w������Oч:��o����F��i������O6:�6���kHQ" X��:tF#�.�a?��=�~l.?N�~�Kά�/��Roz��A(�1�DY��s�~v/9� l�f�9x�����W�J�6�V�Rg �#���(����3�[�9X�4�@�vكu� ]vi����vg3�w5g*0��G��;Z�S� �4V���5��(�lc���cm" C�S�,��@��61ȱ��;��*��u���q �����CΝJ�UjM���K ��Vm��W��є��۞�d�TN;Ҟ����Axڒ��Ҵɍ��qJa��,.�`X�s���;�u�P�p ��m]y>����;�Z��%�t����(RN�@��i�N��� ާ=_��H����u�E���'��d2�������#�B�Ke��c�S���\~��t|�@VPaF@A��?�y�����>8��9bX��?���0e��������b�uv���\k����JeP���<R8��F2�X܌(K�������ic�>����MO��b�դ�4!]!�p �����&��uE��Ff���������Y�ARV'��f'��MF��i&��E�MR�:}y��S4[��)�s�RX[(�ev_z?�hmJ���kf���q��2N���ી�Gl�jfY�G�2H�D�J*�W.��g�����Jk�b�Gb��S}��2��e}�Q���a���!�PDF�ʊŃ0rq��:iJ���X�CN��ϹO�1<�IE/^�с6�gD)��������il9ÜP'z���^��� `I���}�s�^�{S�jeQ!�ͫ���GR<4������yio5�'�p��dAg�%�ϵ���$=�{`0fL���e���_�XILߑ�}kՈ'bI�G�fl���*�&�lG��L������Y��Z��2+�l@�29�G����>��<���J~K��NU�����$��Rz �����B��r�l[/��r���pZD�C_�P�I�fG�,y�eꆢ(�M_K8~�us�9V}�}Q6q�cȠW���``e��M���a\��r���Pt�Tr�|��!ڎ`�aۘ��avx��H'��`��`q�hz����6^S|/�!:��|6;�P=�-=02Y���gh6(N�7��&�M��7ď15�����J���&��ن�( [��oJ�#{$Pjh6Vmp]fP�I�ͅ����M��IL��s�쒅M���� 0���9�<���m� ��.�@ت�)l���ᨮ���+�8����<���W�#C���P�O�_���gN����ʼi^"�Kw��p� E��C�4�~\c��&����_�w0S*�U�xCg|�3(xS�W}��z����� �pi$`��3�ʋ�����=EJGc��J����b��լ �7��:���s �t��;˾�=�1�v%d����p���x#�ꬽ�r�s�y�@��fYdm��VV���fZ9�'E�]�`��.��(��T����_d���L��Vh�cOd����P��y7�:��Q� � �bh-��9�(�W�y�6��]������bS'�C�D�#��͜��:^��'%#��>�;���6{`��k����?�0O~��H���o�����W-^�e��̒�X�fd�����ط?�U7vh��˝���+3��f�����a�W�驪�Gd��[�� ���L�rR�=E}�XD�\#gXZ������s� /R�0�yI���?̡{x�,b�m�9Jr5���R n8��c^�d�$���%���i �KL��m��R4�o��AA��};��Ȝ��4�!I4TR�W���:���<J���#�5��8Vg����#�w,ߣ㑸��;$d�[r���Ű=o*�s�_���hu^�i�M �ɇ/?��Gr���L��ϋXfQ��q�槴��}>D±���?���Q�f�!�2�؟���.N���*�1�;�s���\�8���6�ٮm0�`�N�يi)4��u����N��1��:)��[)?b���1�����!�[X��3�Bf� t��gh�9��l)���Q~C֤N�R#�/[|���w?��K� y e�X\�JfmY6���?KA4��y,��1_*�3^N3�LՍ�yݙ���5ݽċo��a%��C\0�0f�#V�eS;n�~��'(��J��,�M��=2���P�m���.k�E���\Pk�9���͠8zT�2N�Gw0r���p��.v�8w�Q��"�~�2F@L�U,E'�O�t� ����|�=R6��a�j��.��m�������7�J #c�}^�-_����X �sEg�������o6���ҏ��|P�2�����!���E? k<+���R_�E��8�2VxeQ�C�MO��1���r ��3�yb���_�d�\Z�H���]���ͯ�=�C�7Q����Iy<������|i8G`�=��P�7��CQ/����b�G�y��3�����[��1�� �uh�'�Q�O)��Ÿ�Ug�N澨�����o�^�Uh�,�$�6(t�۞�*[�*�\��2I��q��0D�-C�����Zť�-B�@w���(�J~�#��`�Y�dsryg�^�~���㏣��^BN��Ge7�*�E��a�u������Vf9^F��[Z��ߚt���@�hq�*D�QV"�r��&d>�$!-y2��C�P����/D��M���rTD�����I�gdJ�ֶs� ����xK�dr��H4��Ą�/�n��iWojQ�N!���U����(��e�?�u>�������@b(��P���/����>*
Static task
static1
Behavioral task
behavioral1
Sample
2425/LegoTheHobbit+8Tr-LNG_v1.0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2425/LegoTheHobbit+8Tr-LNG_v1.0.exe
Resource
win10v2004-20240419-en
General
-
Target
094163d2713eb8917323fbb2af086680_JaffaCakes118
-
Size
2.6MB
-
MD5
094163d2713eb8917323fbb2af086680
-
SHA1
606237dc5df85dcdb9552a48c9714099e5c6f60f
-
SHA256
44c1d84cabdd5baac5ce631db5f30360970200541c8dc42cf4b2ee438fa5234c
-
SHA512
1e3d4211b654b47a3e3696c8a0c5c0239806319ebbbc36931386b61737fc786058acb7bf2c1500f7956da00efdd47b73861755167b4bc1145c7c70a53ddf3d42
-
SSDEEP
49152:+V9wLK5aIRyPLyymALnmofSnuQf47K+Kyx17SO6UxGrNW3vUXSebxS3zSx7:K9wLKk+m+Q7QR+Zr+ODx6svUCeU3z0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/2425/LegoTheHobbit+8Tr-LNG_v1.0.exe
Files
-
094163d2713eb8917323fbb2af086680_JaffaCakes118.rar
-
2425/LegoTheHobbit+8Tr-LNG_v1.0 - I.N.F.O.txt
-
2425/LegoTheHobbit+8Tr-LNG_v1.0.exe.exe windows:5 windows x86 arch:x86
451711b5079de6f7f4e91c032297f565
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaExitProc
kernel32
HeapDestroy
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutReset
user32
MessageBoxW
Exports
Exports
Sections
.text Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt0 Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
2425/VERY IMPORTANT!.txt