KP�����{_'�oc��e)��ٲ�X8����>M"zv��U�X�Y�=���nG�� �^n<�"eZ���P��ԍ#vG7Ь}[�l��&�������i��$?W ��Y��/r��{�����W�şL�Vy%r,F�I���f����BB����%�L�E����o�y �F3gՓ����s���w�����^Mi .{Bh���I��w#�ӌ,�WG��v�|��}y�������_�1F_ɸY����"o�y40��$��_���@w�*�BǑ0 <G�穔,��yG��y���~�q��^��)E�ֽ���'�,�Y~d'[���AA�%��D ߰I�`^_6�$7_�o��[���bO�@j�-%���6�ڜJMBO������!a{cXE�#ʱ�s�����ύna��ӵ5��Ϧ��f��:_Ɲ���I�q}RA��J�̮$�tjL�M+�B�}�ܤugp= {���Y�$�O�@��/���n-f7��;c�^�-���^j`�����6Y��A�[�0������?z����b|ج�';��É�:���]X:0��:u�j���R s��~R-� "ٞ��uIi� i�z(�����k6�!_y h�HGA�0�O �����Jښ;pBʉ&��O�FJ��1�"�^+l픽V�5yz] �%JwM�S�E9I���iII�ZK�ﲆꭞ�>�G���Ǒq�"[Y�2jߴt��?�+�TpJ^����D�\�Yi��՚\�k+���=�rѵ#���$L�lS�������h�p�C���!t<����P�u6e�Ɵ��� ���wJ���r�f M$V����S�/&�^���R9t�� �UE��O��Z#��I}{���}*��Df&K�-���V�4��f��Ps�Ԓ?P4Ҙg���;����KQ�*jd�y�&�I �\Uc�������N�b�du��͍j*�\5bu:H�y�l՝D$Eh�)$�&��ᲶFy�-i>��dz8�����-��MAV�&|s���]��ڭh�TM�vg_��%X®U��ZB5W T.�[Y3���gd ��=��#�-�}.�T����p`�~Hk����"w�"H�u��Z��1V#�����O6Ng�se|fŧ�6Wo�,��Bӽ�e`�5|�n,��~35m#�#U��y��i����ؒrѦ� Y�<!. d���T��B'��!>��VH&R�Q���n�~�n$�ۂ�{��KnQv���n�W��NľǍġZxn�֍חd�A�+{Ce ��6���%P��Qu����#���We��P,��� �ũ�_Y��qho�$I�j�`��q��!���i�<s����x��[��.��<"��lz��G��?�}{z=��U\���� ó�������V�'���39/�^'�G��g���A��M�?|��/��l�Z��7+`��dt�����8��r}�&�=��ْ�80��y�U�|s�=�U Uf+�)�Zcq>�P�# ��[�v��B�V����}M�à�J�yc�t*1, ��^n���4N�kR_X +%���Q>�כ|QdKC���B���A�hW� �>.Kr����0�H��g��b�c_�A-Ί��Nv����hA�M��� ��_r��m�����`����_Ж�����_ڥu���V+�Y��T�Z�s?�w �/U� �!y���$]'�e��/��X �-��CA�AW��x����3ʂV(P�ݓ_ſa������ku#���K}_� �\� �v��w]:��}�e}B���]��e� t@(�RY/ j�pIS0�!}�-��������ԄC29<��R�[���FJ8�O2-)�!d��G#��aP��YiA�+���C�#�qB5벯ߐ�|lzo�� Їe�l��@)er�m�ƼL�1�ѓp�5�����%t�N����q(j�DG�e@�Qra�l�ٖ}B����������G=��`� � �V�KY��@����ie��#���oͺuG��]i��7����Hx��\��B#�ˈ�,C��58w� �,�|��_Rnz�c�<U�Ih�pb�8i-g�GlH/=���_����H ��*k��Fm!2�<ΰ�\�۪]���XQ2�Dcu"@HZ�����띯�7��//&`����F��� �X��A8ic�oT�M��+�� ����Q�:��UOq��\p@0T���R�e�ly���%�(X瓡{����j �����b>�ź緅�G����Ç+��@��0�=q��Dz�H�t0 ՁzF���H��#���$^OI�g�+=X�d�.�%d����������f6��am���1_4 ��-$_�?f�����ɼJڇ�{�w�n�B�Ӽ��������:�!�42�����ǖ�'[Љ%��5����?�j2Nw�~�?�j�I�[�O��}�'���þ8I1v{����J�e�i���>2�E�A�KLlnAs,>K����=� ¯��uI�A'�Z50���'� �j��/�ɜ��k������p!�����'�� >/���&��i��9[O�U�<U��,"+t#�Qr��� ��Li�Щ��)�lgT����Gϖ�YϓbϿ[��!\�Iv�Ҏ$!���F/�D����>�?6�R(��B߃�K�#�a�Ґ!�́}��y�������e@�D<���l����?�5ٻq�ƨ5FbKU4��ȕ~2�CI��R�I�"H\�K�,�����L&.&6�䜡Fv�%��~��ן*͊��S�_U�A�Ƥ7,�p���M�v���>��R����5���\���L�D�1��5u���p\:�pE�1�����^��r}m����3k�c��i8��A:be�V�����t.��jJ��EÁ��E ��&������2&�Q�6E�~ FiľK���~f���Ԙ�>��*�|�Ǐ�Qd���i�rZ��W��!�[1"d����\8�$���ڊ�����"��pCF���o��Zа|Z�U��9�G�S�V �0���L�J�ngFlk��N�K�_ࣩ�*���g��d�4�h;ӽb�W�
Static task
static1
Behavioral task
behavioral1
Sample
NFSMW2.0+11Tr-LNG.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
NFSMW2.0+11Tr-LNG.exe
Resource
win10v2004-20240426-en
General
-
Target
10c25fa7251e8c2e05301800930655e1_JaffaCakes118
-
Size
2.2MB
-
MD5
10c25fa7251e8c2e05301800930655e1
-
SHA1
df917098c205e02855bac527289ef9af1fcf9cad
-
SHA256
1338a42dd4773b699f4eb337f331bd03b6307d3cf4fe07f27f49f47a8711afbc
-
SHA512
f52b207ae1bfa3c8f1f96d11148fede2de40c4bdba8cbf50efcd7ee952504891c4df4835001159e1782abcd49f42283bb7de247f196629d8a9f8420fe30b0214
-
SSDEEP
49152:vhZM1xHRCZ265Qry/YJTY7hHjjUjkZoy3yMsY8MpWldfV:JZ2ooDyYEhHjjokZXCDl1V
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/NFSMW2.0+11Tr-LNG.exe
Files
-
10c25fa7251e8c2e05301800930655e1_JaffaCakes118.rar
-
NFSMW2.0+11Tr-LNG.exe.exe windows:4 windows x86 arch:x86
6f52a572e5b5925fc681c74df5552ea5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaExceptHandler
kernel32
CreateThread
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutReset
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE