m���|�ϛA����7��}�X���kRQ6�������X4�+WJzK~rZ�����h�.��hd�R^�I�݀�}&��ގɂ�XPZ��h8���jo`�c�:w���V����:����vC��oO��*��/u�3E�e�QM����J���zZ� K�`4���4��{��������%*@�ٯ�bS�����V����l�G���-���JQ ͮRz}� ��]��Hc��m_מo������v����>_���A�0������/թ�H��i���9��IX�;+��=y5��3(�`��q`��Fpw}� ���9� �A�o�I>,Uv"�ݠ$�b6P��ˍ���߮ �3�b�T7 z?�aT��Q��k��-R���V��b�h���&��^�j��4%cxu�`�v�h��΄�(�a���k�"�qЋ�} �V�`����b�FVo��0@�ۈ5���>�� rn�؋nm��>��o�CWx5�i�����n���I�n+7��\���TY��R�^+�i�2e�pL�o�<��:�M#M� g�Pz!�Qզ�����T���Ͷ����i��ˁ_��\�z߈#F���=��}�)Vc|�62[k��=����$ɑ��Zt$���"f�Z��1����e�)��Ū�3t`�m76�Q�s@��kp�b��BT��s�/�V�aX��7Å oW���I��[���Fu�$�/�ʗGC^ [�-�R���]KKe:���@� GF��#�n�N�5���؎C�s��π�f".�����x�H�!PcD�T����� �=���_rz3������4Cr'!��;��V��ꪸ��9d�a���n4[®B:�B��co��y}��/ޘ&��R�h��Bx��7Z��R� �L�پY�����m2�]D$ ��&�f��Z�6�6�3iS22��kݭ2����5_��Ԫ���ܻ��D`��[Tk-f^# �=v�y�r�����d鐑��z� �eRE�U�`p?n�e6���e_�DS-g��{"ɻ)G{��N��+j�؋B+��>${�.���%ݤHB-�@�l����H���gT�C���9z�:�D�f�ό����Ur�ܸ�p��d`x�K���W��Pu9�R���MBkv�-)n�i�� �ӭg��d4f�;��æ��6Q�.����t7Z?1�j�4�%K����ɼ>?��[W��ȵ�����6ح��/��� Z�C�$T�*y=�=Cv���^B7��b@�鎨b ��&�V��%�o7�-i�#�̽e�C�'\^�UJ�heL鐀0d{�+N�P���ʦ��� 1�>��xܓ�>ep_qg�w��7&w��Ц�H���xՆ��*���= �l��b*�����b�]>Ր����d���}�E���ȉ����l�V����It���W<�F=�4�5ą�Y�nЦ��?VYx��>rơ��G��k>�/���F������D�}PM�)[���D�d��ƿ���&H���A���Oo�W�}���&B�Fy�E"��D���J�[ D� ���Qp��.��L�+ł����'mɕG�"<Y�w�R��ϕ��&K��� �<(��?�&��C��|��|A�ؔ��*U�.��o��}\ ��gm|��b�K?��>�[���ޑ&hݠ��W��p]6��z�Yt]y�Ŷ�0_�K.�-��[$>�����E`�=�����Ķ����9c�U)=���¯�[})��cms%Vc)ݺͤ4{6�lm�&�j�?��Cr�= k3�t�H���ū#���V����A(�����*�R��[�Vr|����z'��l�lb��lO��`Q�XEbˢU�J���$�0�9gK�M6M+�$`�;�΄3㲒��zϿ""�®ذ�G����q]���>dIAM?y>�,�-�����:��-����E�5�8�W��Z6 u�8ɜ\=#����P���E�$<��>�TiG�O���ꩰ�I���3�o8�'.|R��� ��M�L(�sSW�� ��])ȇ2@�6�kD�W��.J���D^����j���������0���.�\�#>^���>����@F��=8p��=��]5��`އ�hp����#�$�T��9��s���]Y,��U{`Q�U2�ڤJ�fI�9I:�4 :�F.����������&WQ[e��p�����y���o@�a I܉z�}ߪ�+@x��M� W/O��������T�]�7rj����,����%�c�Z����)�@��\��xqj�l��hw%H�Ӝ9 #�W݅2��_�.��h*@iL5'��B 5'�ܚ�Z���ʱ z�@b%D0.m˄�a�V�R����'0pGd%��(��3������E"�'�6Nv)4�� ��Sc���=�"�U��� k�e�ɀ�9�s�i7GD�/�"q�p����.)�@U�$[��v0���ɭ^eq́bJ��:p*u>P�!z�e��ݵ�2;]{�hg�9$�%7�� 5�7CG��E��w�u9mv��[f�{��F�ҿ�7��@�ʵ��4_���dyd ��B7S1��Ȏ�r6�!,i�C�i���ȳr�6��8���L;Oo�������x;�.lwx�d.+�,��h�y���7��=�3$&�������_�Wj|�c��W��K�y5�� ����^�X�5)���H��̉yD���}Щ�J���� ���ؿ�$�_�FH{�?� ���;� ����/�Df˯T2T���~xn3�bN���J�vf]B =�*���%������ ����'·%Gw����O�8��o��� A�jC����|��K0 ]�>�BA�u�"�:�߅%�������7j� �4�@����(X�WW��;0�W^��@��i���9nk���'U/������p���AI� v�\�C��A��֕�Y�=�bJ�7�V&����9(�)�7_���T�G�P 唢�{�1�+ݍ�� �����Gqnh�@�j�6�mt���S����!^Y�?p��h�c�� a���;�yl�z�O��j�nB��`
Static task
static1
Behavioral task
behavioral1
Sample
Cinema4DR18/Maxon Cinema 4D Studio R18 种子 注册机/Maxon Cinema 4D Studio R18 种子+注册机/xf-c4dr18.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Cinema4DR18/Maxon Cinema 4D Studio R18 种子 注册机/Maxon Cinema 4D Studio R18 种子+注册机/xf-c4dr18.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Cinema4DR18/咕噜下载.url
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
Cinema4DR18/咕噜下载.url
Resource
win10v2004-20240508-en
General
-
Target
28e6822209f321f0cb9f28997bb2af1a_JaffaCakes118
-
Size
2.0MB
-
MD5
28e6822209f321f0cb9f28997bb2af1a
-
SHA1
9ccc5b31fd18a41cbe52710dd787f67e22539f18
-
SHA256
2d2f494af46de5aeacdbe0eb10a6b751105839d83dd7055c6b621132a8484bb9
-
SHA512
9262f8ba2d8b4e78b1f905a43888e346ea731ec38d6df9903aae9a9db5b6773617cd7140b975fecda8bde189e9640586ead00dda3561c88a96d29c0a76cd00c7
-
SSDEEP
49152:1Ka7g4sQxaSB3SWrHd7MGheizyU9HMBlU9M8SZivB:1jsLySWrHd7MGheizQlUIEvB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Cinema4DR18/Maxon Cinema 4D Studio R18 种子 注册机/Maxon Cinema 4D Studio R18 种子+注册机/xf-c4dr18.exe
Files
-
28e6822209f321f0cb9f28997bb2af1a_JaffaCakes118.rar
-
Cinema4DR18/Maxon Cinema 4D Studio R18 种子 注册机/Maxon Cinema 4D Studio R18 种子+注册机/MAXON.CINEMA.4D.STUDIO.R18.MULTI.HYBRID-ISO.torrent
-
Cinema4DR18/Maxon Cinema 4D Studio R18 种子 注册机/Maxon Cinema 4D Studio R18 种子+注册机/xf-c4dr18.exe.exe windows:5 windows x86 arch:x86
d711d67e7f79feab4da4bf071f51e749
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
VariantClear
advapi32
RegQueryValueExA
user32
SetWindowTextA
kernel32
GetVersion
GetVersionExA
GetStdHandle
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
SetBkMode
version
GetFileVersionInfoSizeA
comctl32
ImageList_GetBkColor
Exports
Exports
Sections
.text Size: - Virtual size: 458KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 19KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 56B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xf0 Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xf1 Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 62KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Cinema4DR18/Maxon Cinema 4D Studio R18 种子 注册机/Maxon Cinema 4D Studio R18 种子+注册机/网盘地址.txt
-
Cinema4DR18/下载说明.txt
-
Cinema4DR18/咕噜下载.url.url