���.'9D .��x��<�K�̉BV� ��~1��������0�5��\��'�s�����`Ů�� F~B���O�7�.�4��߉�X����B�HB]��H'��=V����7�{/b���Y�iJ_����{4S'��|aC��&ĵp�iġH�j�������^��ϔ�?wq������rL�c��X�i���{]�.���V/Rb��cW���<�,�N���S��2� ���h���ws�g�O�� z���put��)9A���z��9O+��^.�@��5�CN�Y�5�Ч�ZV�DT ��=ɏ��K���[&df�ːg���u�f���H=�I��1�'�U"�C�O_���&���.�s�O���4�� /0���%hY�Gh�(��������oH�PD�-�4;2�??�"���?9�j�%<�����L�?��yfC�>n=���ҍ���tI_�zL�kM��E\?��j��ݏa��:v�㍚�ri��눞{VV��@Si)j7��B3��&�]��Î�%O�_`*��,KaH ��ǩv�*^ߊ��r�&E�1�ʮ��e��I���~�+i ���7�%Q]�82?y��iڋ�����fl����8|�>�Q-���I�P��9~k���l�8�OMGE�*�j�aVj��l;X�T�o���|V��YZ�G�!9�{U�]u�n�놘j��'1u���j�`�?U�����6u'��KJ�P�ϻ>� XYƯ�U4�9�F��c�s��[a_['dAr�����E����Զ5�`p���l��]��DMb) ����� �yh`@�j���)D�A,��-�S�l�� ���I}��ֽp6��{���W� ��*�6�Ȑ�U�SV�q����@�N��p�\B�'�3a�φ)LYe��|�պ[�q)�X\C��<��R����:LݞP��%"�f2��y�$[��z��Ų��ExEm�3F@�=6f\;@hZ�=�3������S�Z������L��RH��Cپ@d�F<�I��\r�t@N�GDG���tN�j���N�����GcE.Ir�'�9'^�FW��׀a�+{���� �P6�B���b=�ɐ\�L@��L$ P�kF�&���;�kHj�^u�f2Ut%c��y��D&&0��Y"�Y�.�@���ڍ���Vju3<��i�"�u�鴪Ҟ�����[3���6��w�_�t�9��B�쎃@��>�㿳!�$��_5k��&:F��?��l�F]o��-'��;�).�����G��,�%:�Ƚ�̲8gvB�A�j���<}�˜��\��HΠ�M<&qp�ILg!+�؟�,�^���H���k�==��d�8�e'����n;�2�{li��� ��W���(5q� �S]��鹘>,I/^��o�(�5��$�X6~^&��F�>��5��z#�;73(��\�5up��7�.��'� ,w$`%vz��Y�o7������X���^��gJ�(� ��P���N������&F?�����$s����-���z���Nܼy$�}C�頂�����5�����1�Y4��4V��Q*Z��э�|S�HA��Ǩ�x�x/4�;�KI��#��F Otf�+!6�8i]Y�]0o��?�* Q����GakRn&�e�ϡ"ed��<bܰ�o�([����M���4�O���L�QO��Y�9a�^,��DK|���mzoJ����_{�@��òcO�؞�s�>@6�8�S�l��Gb��()�)�a�R՛7,�������Am�Ϣ��rv�?�B"1}�ӧ�!�<�a ����O��U�s��D��xz�dX'��\E�oZ���* �����.�[u�p.���W�����Q�?#�)l��X��Ϝ���UcNth���L5����<b�A��G�q��(��Aa�X S9�������B�V��+D����viɇ6���������k�H�)��%�[F<�Jl�,�=���}!�tW�Դ�H���¸4��s��@?o9�Yj�fD^������)-Dam��k/�zm*I��!�_��ɪo�A7�g>ዧ��M�-A��z�L�O�����'V��ڜ@*�\.C*)��j�%Z��~K�EMuO#Й����V6���o%�Ip��_��~V�Q%5*z�k*�wK���7�}��x�{�{�p��<$�`�T�Oo����`(�Kr�*�J9�S��| ��^q�� ����ֽ����y���=+4ei�MG �����'��m}ކq:�� �ۨL��N)�wn�%>Z1��9�H�a?y��8x�s��@]P�{|�O���~/$�[8��ԽqS�"/{�v�3��e/�m��.8���$)���e�qkX*���U������!�A���P+`κ�S_�����pE�(�=���+��,-�����(r� �a,f��%$��5��r��g��ee�O�g��SsV�`����g�Z��e���q7IG�x�i>r2��3�c����1�J�d�gⴔ �2��haw�z>��Xd�R"0U����˗�k�[E����S��zt [�ֱLٛ`k����?k}�p�-�Hd�:�g���`���A�~W�j'-?[G�MZO �l ̮W��0�!�,&eתuO�0�#5K����{{�ﵝ(h\��5�I=HZ�$:��Y��X��ǀQ©�n�!b��N�,(f���8+m`#J�z���.���JYV%�^����'��*�T�3�wh�/����U-�����}H�� Ro =ѹ-��D�vX�� ��TeHS!�0�P�rJ`���UQ~]=�uD����.ć�=ȋ�UiD�������?V�?��Em�@ӏ}�@;��������Ɛj����C�ap��Dž]cR5'��\%l]M_wҸ��l���Q��9=#Sw��d�� eí�?���3Cn���@:SU_D������~��G��1�����6 �+<<��#ۧo����-h{$F��$���O�q��Hv��}�; e���drO#_��xZVJK�y��,�3�����a<�V��j[����/[���r�8*KE�(�H_¥��V�C��nF5
Static task
static1
Behavioral task
behavioral1
Sample
BF4+13Tr-LNG_v1.3.0.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
BF4+13Tr-LNG_v1.3.0.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
setup.exe
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
setup.exe
Resource
win10v2004-20240426-en
General
-
Target
2726e12fb1510a4e652a92715172529e_JaffaCakes118
-
Size
2.7MB
-
MD5
2726e12fb1510a4e652a92715172529e
-
SHA1
7a6d7fc2db6da4462842c0da7b4e3a12d5003294
-
SHA256
21649e539e4f0bbd03c6b459f95da690657c61446b358d2511eb037f92169be1
-
SHA512
ef6edd8b86152bb35d35d6cf556f27288800d838118691277bd6ff6688b7fcb23c0f2255e06a260d4e39eb7fe8acd12249642fafecb8cb1deca3ca4fb0d8b0a1
-
SSDEEP
49152:b3vjlZO7/366B1514DIBUMZ3C8g2F/sCb1ExJKJpewG4qQ8Yh9Ww:rvjuD6A1514DIBUWyamwmrYew
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/BF4+13Tr-LNG_v1.3.0.exe
Files
-
2726e12fb1510a4e652a92715172529e_JaffaCakes118.zip
-
BF4+13Tr-LNG_v1.3.0.exe.exe windows:5 windows x86 arch:x86
d76902e19f9e4578bef32a1486b7c05a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord601
kernel32
GetLastError
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutUnprepareHeader
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt0 Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
setup.exe.exe windows:4 windows x86 arch:x86
b1ce86732ca5e0ef531f0a541177d693
Code Sign
19:9d:f8:72Certificate
IssuerCN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CNNot Before08/08/2009, 01:00Not After08/08/2024, 01:00SubjectCN=Time-Stamping Authority WoSign,O=WoSign eCommerce Services Limited,C=CNExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
19:9d:f8:8eCertificate
IssuerCN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CNNot Before08/08/2009, 01:00Not After08/08/2024, 01:00SubjectCN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CNKey Usages
KeyUsageCertSign
KeyUsageCRLSign
0f:cb:93:7f:07:32:59Certificate
IssuerCN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CNNot Before18/03/2013, 08:46Not After19/03/2014, 18:02SubjectCN=南京凡游网络技术有限公司,O=南京凡游网络技术有限公司,L=南京市,ST=江苏省,C=CN,1.2.840.113549.1.9.1=#0c0e70756a63406b756169382e636f6dExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
Key Usages
KeyUsageDigitalSignature
3dCertificate
IssuerCN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=ILNot Before01/03/2011, 01:00Not After01/03/2016, 01:00SubjectCN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CNKey Usages
KeyUsageCertSign
KeyUsageCRLSign
01Certificate
IssuerCN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=ILNot Before17/09/2006, 19:46Not After17/09/2036, 19:46SubjectCN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=ILKey Usages
KeyUsageDigitalSignature
KeyUsageKeyEncipherment
KeyUsageKeyAgreement
KeyUsageCertSign
KeyUsageCRLSign
Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
e:\Apps\release\KuaibaDown.pdb
Imports
wininet
InternetOpenW
InternetSetOptionW
InternetOpenA
InternetCloseHandle
InternetSetOptionA
InternetOpenUrlA
InternetReadFile
InternetOpenUrlW
HttpQueryInfoW
msimg32
AlphaBlend
comctl32
_TrackMouseEvent
riched20
ord4
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
kernel32
GetProcAddress
GetModuleFileNameW
LoadLibraryW
GetModuleHandleW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetCurrentThreadId
ResumeThread
SetEvent
ResetEvent
CreateEventW
SetFilePointer
SetEndOfFile
GetFileSize
ReadFile
WriteFile
FindNextFileW
FindClose
FindFirstFileW
FindResourceW
LoadResource
LockResource
FreeResource
SizeofResource
MulDiv
InterlockedIncrement
InterlockedDecrement
GetConsoleMode
GetConsoleCP
VirtualAlloc
IsValidCodePage
GetOEMCP
GetACP
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
VirtualFree
HeapCreate
HeapDestroy
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStdHandle
HeapSize
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
ExitProcess
GetModuleHandleA
GetCPInfo
LCMapStringW
LCMapStringA
RtlUnwind
RaiseException
HeapReAlloc
CreateThread
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoW
GetProcessHeap
HeapAlloc
GetVersionExA
HeapFree
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetTempPathW
RemoveDirectoryW
SetCurrentDirectoryW
SetFileAttributesW
CreateFileW
CreateDirectoryW
GetLongPathNameW
GetCurrentDirectoryW
GetFileAttributesW
DeleteFileW
CloseHandle
MultiByteToWideChar
WideCharToMultiByte
WaitForSingleObject
GetLastError
Sleep
GetTickCount
CreateProcessW
LoadLibraryA
SetStdHandle
WriteConsoleA
GetLocaleInfoA
GetStringTypeA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
GetStringTypeW
user32
ShowCaret
HideCaret
CreateCaret
SetCaretPos
GetSysColor
FillRect
DrawTextW
CharPrevW
DrawIconEx
MoveWindow
RedrawWindow
ClientToScreen
OffsetRect
IntersectRect
CharNextW
IsRectEmpty
DrawFocusRect
SetCursor
CharNextA
DestroyIcon
RegisterClassExW
LoadImageW
GetAsyncKeyState
CreateAcceleratorTableW
InvalidateRgn
GetPropW
GetClassInfoExW
RegisterClassW
CallWindowProcW
DefWindowProcW
LoadCursorW
SetPropW
LoadBitmapW
GetFocus
IsWindow
GetMessageW
EndPaint
GetUpdateRect
GetDC
CreateWindowExW
DestroyAcceleratorTable
DestroyWindow
ReleaseDC
ReleaseCapture
GetMonitorInfoW
IsChild
SetCapture
MonitorFromWindow
SendMessageW
TranslateAcceleratorW
UpdateLayeredWindow
SetWindowRgn
GetCursorPos
DispatchMessageW
SetFocus
GetKeyState
ScreenToClient
InvalidateRect
BeginPaint
PtInRect
IsIconic
GetClientRect
IsZoomed
MapWindowPoints
GetWindowTextW
GetWindow
GetWindowTextLengthW
SetWindowTextW
SetForegroundWindow
GetWindowRect
ShowWindow
GetParent
LoadStringW
PostMessageW
KillTimer
GetWindowLongW
SetTimer
PostQuitMessage
SetWindowLongW
GetSystemMetrics
SetWindowPos
TranslateMessage
EnableWindow
gdi32
RoundRect
ExtSelectClipRgn
SetBkMode
SetBkColor
GetClipBox
StretchBlt
ExtTextOutW
GetTextExtentPoint32W
CreateCompatibleBitmap
CreateRoundRectRgn
Rectangle
SetTextColor
CreateSolidBrush
SelectClipRgn
GetObjectW
CombineRgn
GetStockObject
CreateRectRgnIndirect
BitBlt
CreateCompatibleDC
GetDeviceCaps
SetStretchBltMode
GetCharABCWidthsW
SetBitmapBits
GetBitmapBits
TextOutW
CreateEllipticRgn
CreateRectRgn
CreateFontIndirectW
GetTextMetricsW
SelectObject
CreateDIBSection
DeleteDC
DeleteObject
CreatePen
advapi32
RegOpenKeyExW
RegCloseKey
ole32
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
OleLockRunning
CoCreateInstance
oleaut32
OleLoadPicture
SysFreeString
SysAllocString
Sections
.text Size: 428KB - Virtual size: 425KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 80KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
使用说明.txt