�v�����%2 <�0ړ|�j�)~�Y,b�����6?o�[&i���j�U�,��m����o0�_���y|��s�m�l��U�,��ajyP�S��q��h�j&�m�������,�&e�2���Aϰ�ۊ��>I)�N,L�ҁi0vN�|���հ;'҃.į���pj5��y��A�ya&)oE�t�_�v=��_��t�%d&?��G.�f,���{��X����s�������{x�hpř����\�J'�5��8�B:�T�n��n c�˪��f��C닝s��(���.F#pΤ�����/��J_����.��?�6�~��@u�*��5�,S��h)C?���#b���4ݯ&�����0)���J �{T�(hV输T�HO�2�M�Сl;J����19@w��?�z Fv�������aĺ����&+nv�I҅�U��X���T&9�C&����O2�7�������u����DT��R�� -��:1 g����4��#�D��I��]�J'}p2cߡ�F� h���d��v(�Y�截,�p*f5y.�E��� �%��[��Y����!x�QmyU�-Q��/�!Ir7��ݏm�R*��í�����:�j��џmuB|aلC�������;f��3��H�L��eK�O��}O��I�P��Q���/ǿd!؆*P��¿�N�Ϲ� ����L��<���'�"�n���}�H���ۯ���{��>����ZK�f���'����4��8��;T�[�������Č7�wg3��8���9+|����Ž���,�~��>ܩ�U���Km��+���1�}����S�^�v�PL�u���`���I����.*�o�=wN�� N��Z{phĔ%��뺹lCu�Ț,�=�㲮���i2��~缧Ev2۴���?(������>?���B�^�0 8V��ߴY>p3��ٍTl�It�T�n�;{}��$��[O�~�Ɔn�l�na�r�OJ�V6]�(��C���k�����|��)%��ټ� �T*��@2�"{�����O��xK��N���;���AV�,�.fc����� ���C�|��)���WF��8nP��k˃ߧs�&�Ѱ-�澟7����.%�w���O5���gt�l=�/mײ<�O�<[o5��,��F^��t:�^��b�d�o����?�z���3+1u��gk��9�?��$��7N���0�E�ҫ���4�Ae��.���#l�Z�P�wMFY����z�,���`��U�����zu(�bm�[рW����jA��M���q�Y�J�m�T�㼷Ү�&K^~��<�Ok��v.�����e��o^��l@��t���&xD� �oq�e�klR��������GY�(`����c�HF�',.����JI"v=��|N�)��8�I�W�: [���ИX�/A(K~>�n�A��M)��R�co��H"��K.�?C�x���vf��t�"��h��K4}�6|�X�9� k@������C�W��=�F���3�g�@� ��S��2���S�U��Փ1�e�1����p�`�0%,�_��d�o�`� Tܭ���g���_U��V'"[.�*�$��e~����p��NT_�W"�dz ���)�E����M�M!�u��P�c��1���g� ��:��S٬o������ �hk��9�8-W���>MC�.����s ����G��'v�=CGå0�BI�#�4�e������\�N�%��W>��#�ϯ1:j)��6��ZPb��y��I�l<S3�%�N������t��"(�ш�M7#HפX%��@�5�21�0Z��#zD����*��B�V���Nϼ�ƌ����4��S.%�\���&�0&�:D��B�0��i}gX��v�{���qj�Bz�Ը+��}f���=��÷����������j��t�㐨M�'�0�H�sU�٠���7�6�����@�����()�M_�'�/��nM:{��,�?i��?h���Y���f���W�Am���Ghe�w�yu����R*a+��9��}�4�`��o�r�FzA8�57�W�N�@�_�U]�K�]473s�|�9� MֵK-��C2��՞� Z�]�]�����Br��20�=NM��b���i�`kr*P�`K�/�{1/:3����OxZ�`�O&��I�*.[�]b���QQ 8g֪��pޫE�~W�hh��x�:���yϝw���Y�o]�z�Q+4�{���[��qx����t� �RHbV��z�§�)�� ar��� ��g��eZ�$)��)�v���� ���nEQ_������+0�!1��pGoW֝��a���2��F>�.�UmMLZ^)�����.s~#��6���T�y���KQ!z���˜���kX�X��n\����cog��b�o���\O���;�XH��\~��^_���Y�L����и�nq`��L����6����5�G8w-���m#2'����&'T9.�J7�������8C��V�l������E8's2�?�9�X�Gb�p�1l�\��hX��0�y_�<P����aa?�E�J�ؑG��� �k�Yܹ������o7���8I���ܞ;�,�C{��}D�u�#���j����(��?� �G����@��]����y{�g+�j�[���p��.���6~:�p���S�x��4?N���0@�����=��0�N3{���?����kX�?����(~�5�(�M�ߤ%2y%俑h�1��ȓ���x<6�!.�p�y��=V�N���+�4���*C����%��:��z���e,h���:�q�Ƒ-�N����p�\���SIi䅁��@��w��w����Q��[�֨�Nix�3�f�S�aP��>Y�_�vh/���:�\6!��(t=w��S,�� Ir��!v�ɥ����[y�x���^WsG$LXF�]��&�_�)�Vnv��'�d�G�q<��L�M�|AҾ5�J�/�ҋf�Hݿ�рF�����x:�oFdI��H��[��>X��@)�,��|9�.�x�� ~F�<��y
Static task
static1
Behavioral task
behavioral1
Sample
Darksiders2.v1.3.t25/DarkSid2+25Tr-LNG.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Darksiders2.v1.3.t25/DarkSid2+25Tr-LNG.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Darksiders2.v1.3.t25/游民星空 Gamersky.com.url
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
Darksiders2.v1.3.t25/游民星空 Gamersky.com.url
Resource
win10v2004-20240508-en
General
-
Target
30e14bb5ac65de9c49ac4d5d7ddad138_JaffaCakes118
-
Size
2.2MB
-
MD5
30e14bb5ac65de9c49ac4d5d7ddad138
-
SHA1
3f84075e135df56a26def04c40f11e64ee7c02f1
-
SHA256
ed55392ba2ce3e7130b8a14dc2a09c6178297c386ef14bfef68e574493e3ea00
-
SHA512
940245824a8f20572becf76038224d5e7de2088d89d61d47e6fb56d17bc08de0d02ecd5381d72da19e9d4aca000462c17e3730f481e8d304ef3432415639dea7
-
SSDEEP
49152:2Y5q4Mpag2+tDbOCShvoOaxmi8R5XpdaEOf5HI4stLtkPWw94uoM:VY4sfl2CxOawR55YfFI4sgl9XoM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Darksiders2.v1.3.t25/DarkSid2+25Tr-LNG.exe
Files
-
30e14bb5ac65de9c49ac4d5d7ddad138_JaffaCakes118.rar
-
Darksiders2.v1.3.t25/DarkSid2+25Tr-LNG.exe.exe windows:4 windows x86 arch:x86
c376a5140d86ec9f4336a68fced53a02
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord537
kernel32
HeapAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutPrepareHeader
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Darksiders2.v1.3.t25/下载说明.txt
-
Darksiders2.v1.3.t25/游民星空 Gamersky.com.url.url