��2�US,y�WW�%c&�44��Vb-Ҿ��6��W���g-��\�J�ܭl�L���&�����)2/�� �Cr����GK�;a鹙(?��.��}P�����^��#Bn��Ɵ�J�,B�F6��j�&'����j���"v��M���xҿ���]��guI#-)?���4�����a�H@��Jշ>c�h.�M Iܵݓ�tZj��Z����=��ݝ�sM�g�7��bȝ\j*$P���61��qz�F*-�ƦuM�K��R��aMn�ic��46�� .N��^/��x��"����6�@1�VWF:K��Y(�p����kuR���߁�����-ծP�п-c4�Tʨ�f�K���o��C~�R:� 6㶌�n9����[hZ�zC� �V����b�������]k�Z���|zS���;q���+TIbF� u�rm3x��d�e�cB��c�Қ�̾�\�zV�4�q�! 9CаC�)�����,�i!O���v&�B� �%)��<Lu�`��+m���r�ͅ��'��Y6��%o��SM�{�V�Kd��X��LC�gユ�ZP�r��F�c ��b;�W��5s��� ��%L/��!@Z���r����Df^H z&63�.��Y���a����r�r������ƒZJpK}0[�2В_7ں�k#ɔ��}_{�|*��Ȑ�x��r�*�j�� �Sk�8����+�T�m��й� qu�!Z�I��ו�� ����n�Fޢ�Й���*3�c�S�-���t���7�l$�)��r�����A���677��e�<>Ԯg���*�)^us� :6��K�`^ۖ����A�H����7�A�%��Z1���U����;�J#���Q��,������J+��P��M /U��>34�o�-���}�|����I�I~�"��/|�^'m�`���tʃۇ��=�U��=�M�H�������t���Q�G� 9���P��j!�R�E�$�~Ӄ�"C/������νd'�9J3wer}l�s�q���dQ F�=�5�t�0��W��{�15�'@Dl�Qɝ���`��3+�72��ڨ ��m�Ó)09%����f�������i����9@J���P3���M�]W�����fS!��;e>oi���Z����N8�v��C������V�]�:�D�M�>���|ɞH�/�7d*��X��g�wC�c������%-��SW���)E���Iio%���?A����'����)ᇦ�Ǘu�nm��P��Y��_��t�P�/-:2�����(�Xϳ���s��u�ɀ����%�{f��|�Ѳ�#Mfl����(������X�`��x����2ffď����g,hO݁E�@h�-li3�6�s��Y��K��Q vn�� �Ep�����a�/�X�f�J ���W���cn��Țh` 7�Q(�0��1�4�TE��繽y�6�Ĺ^L�~� ^���o��Zsx8bg�v@�%q�մ�������d�5�j����p�w���K~�}�)�����[�Ytk/0r���cO����A��Eס�h���;/e%�����e7铍I��]S`��}͵f���py�E� �W f�s�R�]�5��������l���T���j������H%{����,>"Ou*�Ѳ��}oY:-]�Y\+v��QD�?��Gi��7$�o���O���$�Ek<BU�I��rx��Qs1A��'�{���\aC>���%!�ke �=��6�AL'm6l�� ����;������1`�U��f`�6u�`Ln��%�CX|�f�8�3K�f{�G���J�d����Ư���#�|m;<Nvz���?�Rf��3�k�����c¡O���H�P��~������K+P�<p~�A�pT�)��v����,U)�K�5�=������c������`G��c�Ɩ���G�HwV^�3tM�ZNx'�Y�6i���T��2�rx��SgF#�`����x+�~�c�tز��_��_&�zwl�b#P&��aq�i��蚶�ɜ�9��Q5X^�*6�1"�)��{��p��2���!�`,�vI�g�������i����<I����]���uB֧Ej����-��tB2��M\��^X���,��T������+ޝ�yj�p4��,�� <:]&P��pC�x,-�l�J��ͮ�{��mI��:��9:}R���Ɖ��[�$H�bpG�łc� ML�Q�*������ v�vO~PE�rBB�/�N�VH9�`��a���g��XV�T�;I2��.��i�Q�p#_t��ިb�w��� �[([k���bd�G���Y_�]�EX�����+ D$n��?�"}�S�A�}�� /�uJ��wV �9�jLҠ:�s����o���FhĖ ^�on,���c�If�DÚr�"C{����r���r/��1����P ��I�UR�T�A7�����! ���K�sz2�*B<��K�;��1.ڞ����h=\-\��'/�)�1��f�/a��p9��1EQ%5Z� ��X #ۈ���!��|!�_���hՈ ����h��%R�����rk���{� `j�`�2���u3�Z����V�.>渝Q��SvB�!�/��?N���#?�#X�����2�* bj���Y'쫗�q�����u��`X{=�\��b9�<�B*1����������V+<��Es쭷�n�*!��b�Y͞i��|>Rb�5c�B��0������$���R�qJ/> ��7:1p����Nt�O�)�c�O Ջ��Dc�����V�⊚�]�����F����1g��(ex�6����A �l��m773�b2�R�mf�E+a�@�lD����E�7P��,��_ ����fY0� )�^ǎ}E��Y��Ѡ����O�+����x;��������S�����aﵴN�;C�yq�YBTF�ď%-���fG���k'��m��h�|���η�\�r�,�%�T<����3�h��S�=[gH��/G�*:V��U ^��v�qp_F��=$��RH��O[��B�J
Static task
static1
Behavioral task
behavioral1
Sample
《质量效应2》v1.2.1604修改器+17/ME2+17Tr-LNG.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
《质量效应2》v1.2.1604修改器+17/ME2+17Tr-LNG.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
《质量效应2》v1.2.1604修改器+17/游戏大全.url
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
《质量效应2》v1.2.1604修改器+17/游戏大全.url
Resource
win10v2004-20240426-en
General
-
Target
2d46fd84f257ca9d37b9442c5df73d7e_JaffaCakes118
-
Size
2.3MB
-
MD5
2d46fd84f257ca9d37b9442c5df73d7e
-
SHA1
e66aaea31d63ea77046ebc9bb07d3acef66f5a48
-
SHA256
1a63787328932b929278368730dc584cdb9e0ad1a82f19d3c9a83adea45bdfa2
-
SHA512
9945fc8c080268e8e362dd21e6967e897cb0e8014406663fe3ca4118a16f833f076e3cfa2197e3eb83f8777127ad84b71599f38c4375da59d74ac4f9d6143fe3
-
SSDEEP
49152:SJxWdx9twFX85mreFaRWoHN6NItUV9Z+upwq6m6t2eSKpV:SDFriY6NvZ+u+q3eSK7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/《质量效应2》v1.2.1604修改器+17/ME2+17Tr-LNG.exe
Files
-
2d46fd84f257ca9d37b9442c5df73d7e_JaffaCakes118.rar
-
《质量效应2》v1.2.1604修改器+17/ME2+17Tr-LNG.exe.exe windows:4 windows x86 arch:x86
6136e6e0b53137282f98fa86f4443693
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarAnd
kernel32
HeapCreate
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutReset
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
《质量效应2》v1.2.1604修改器+17/游戏大全.url.url
-
《质量效应2》v1.2.1604修改器+17/游戏说明.txt