h�c ��w�bӇE�[}{o��My� ג�^�bC*:Y��M)��h���>x��_I.s �^��e�ì����3��n�UxЄ:ƔT��×�<f�|�4���*0 �g"����@� �(bk$r���tP�l.2���p��}ѵ"w�K���zu�m���j���ds����ve���z�)�?��'su�1�nY��Ϭ�,FwF�5�_���B�a۹���`=A0�b0LP0��!�ق#�1�Q�cZ���d���؊�'��TIF�deot��2Of<�Ĉ*$*�[����#@�"�}5�u�21,/A�BG�"�>��a� ����S8gk_��rOπ��'��\����N�E��N�ԁ��fr��!���ײr��J��6^d�I��2g2��ml��8��($���1�v�mܫ��C�}�{���9��>N$D��{��9�|�����!G����*C|��S�(�3���C�: �튣a����$�.w�`��]�X��y4L���ǁ�(:[5��@O�u�_�T�X8��J�R?�P��;� ��_Xǫ��&�|�/�/-o�`S�[.�vju��f[�A�*HxR�����6oUTN�8�1O� ˁa<`�~���AQ �+ȃ:�3�՚��k�[E>����l��?]�Ej��跐}g�G�?ڜNA�-�؝��"m(j��o8���� 4f��J��-�n�Y,%e {����X���Z��T���$?��evv���roz�YH��$Eұ�A��.��2�-��[^y�ܯ]Y?��?,��d���/%���8P��� :�0R2 �%\LJ��Z�����[e�`�^��v;}����P'��ۢ�,�����[��_έ%ȓ�� ��0'>�o�=V��_ojOC,G�u �։= ��~�� ��Ȝ�z��#�������}nA^}����������p:�e.���]є�F��Ŋcn�A��^[�A�,�����@Gq��4����T�ڑ@�0h\�%e��G'8����Ş����+����������S�B}L��V/I��E}���Աeړmѱ�8Q$���< "Ӯe�}�u�D���'aT���8��y�j#נ�+�zW����(:K���(�lXg�y�I%urOj6�\���J߉��:��O�h�m�l�Ir�54���#?�����I]>sy�}7[�Xj_�=GX� V��:]�-|��ĠK�� S*��x] G�)dSh>q�A��08])��^��ڻ���� C�~/4G\{��Pg�LR6~��6bQl�����ˡ�!���/�\�j�@� ���]� $Y��v�n*-�`��u�:�-����'2_?571����a�T���W�4mL��P�K��+wqҹ��3=�(r"�ش��f�J]&sCi��=����������#i<Իj.���/���5k�w�#噥y�ʽeD[�k˰��cĒ�Dqc1 �y����F���4َ_� ���|Qὶtmzܘn���O���gYR�!=y �.Rr_�q:�N5_�wȵ2":�0y�e�Ty!�������kh���kQhKS�7_����S���!�J� *�qeB���Y��c����2鏣J�P}�.k=\��N�&���%4y=4��!_粧%�ʅv���-)+Op�P��<������B�ަ{R)츰9PYcQ�����Ad�4�Z�q�K�ESp��x;6^�b@�x���@]2d\s��� @MTJZ-�t8b�����6�\��S�Z��"h���2�y����q�:����'�����(/68�a%)/���(�a���a��+�ev������〧-��g��0������� P_b���b?����un~��>�2�L�z�0H'a*�XLW�nwP��x���Uc$��{B^}�e@u�K�ୗ���<us�Uco_��)/qo��>_��v���,��J���`#�g �Z}�p��:ζ ��k���\]06 ~_�H�@��b4�>����`Q7�8Ǣ�Щ���H=�9�0�9�+��20��3q��Y�G9E�<Mܯu�"��M�%�qi��(��Z��JB~է�aZ[�˄B���q,@ɽϑ����\Kb/��?���_�#&����%��M��g輈��%Qj%m����r �q����/�8��n���-�~\\/#� b�Gn��X��hD�T#?�4oU�E)�_�ܫ�ȁ�2�Q��G�zS\���\9t$�d�>j��HIې��m_��e��eHM!�1G �#2�pˇC���v��̩�#� ^�DL�-;���¿��Gm�ܥ�V��!�>u��%"���ua��鳇��5-�[��1b�)�un��<r-�HnD�0똤��t���-������@>*鳕�����]�� �d��%\�T����RͅX�ö_oZ5�����O�xF��\�<���3Dyr&� ��Jb<ʘS�o��|V=s=��T7S�����x����l����!�Dzi���,�K���9H�={�Q�� {:w�/���ެ�:�O���;��e ��缢t�N�k.�6�K�N�^�H�t��q�ET��!z�L@���D����H�jQcXzwnvD8m�10O��BV]k;�g�nW�y��3�1��+!��B��KIQ�cI�!F��a2�MK;S�.���9�邈_�Õ�X�.���CZ}�*��h��o��]�4ByW,��� B������,PE�+Lc(u�*�غ=��������dV<�}�9�i�{ ���4���dT���� �A����u���(�.�h��\�l�Q��Ll��QFQ�3oxO�N�.��a;��9��qݷ�Q��o�l���)�e��a"^������@�l�^��DH]���l�c�Uu��Wxޢ(z���4[�٦���'�ސ6���ni����ӟ�#���Σȿ�H{����%�������iP���M���O�uO\�>LW�V�{I�5�ha�݂��)�����F���:#�����#���m�3�|�e��vX���O�U�˞���Q�j�B�c�A��]��Q��x�@gI��rPe��Ӟ��mn������������� ��b�e��
Static task
static1
Behavioral task
behavioral1
Sample
2012年全部热门单机游戏及汉化下载.url
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2012年全部热门单机游戏及汉化下载.url
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
nba2k13.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
nba2k13.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
www.3dmgame.com.url
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
www.3dmgame.com.url
Resource
win10v2004-20240508-en
General
-
Target
369899d019398e359925592b25f3c680_JaffaCakes118
-
Size
5.3MB
-
MD5
369899d019398e359925592b25f3c680
-
SHA1
d5b4af618ee969a6c2444e3e981730681c4cafac
-
SHA256
f5f6a6eeccc88ce726aec57a7d0b8896ff1f857197efd80d073a0e80e5d52a79
-
SHA512
b5f6f846f12f8d18a02b92056a0352e87ffba1412a7661738661d4005c6c8cd04d5d281858fbf636ad56b54e62012d7c00c8eb9f3d577315544da6125a73ddf8
-
SSDEEP
98304:XEI29zK/JoLRq0AtCbk/vCkk6OAMu7WSCa73d8DNuXd3dEIy1kwnZ/NTd6UXDzri:UIGzas1bk/Q2+BuX1dAk4LXDX0D
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/nba2k13.exe
Files
-
369899d019398e359925592b25f3c680_JaffaCakes118.rar
-
2012年全部热门单机游戏及汉化下载.url.url
-
nba2k13.exe.exe windows:5 windows x86 arch:x86
397320349fd370812610410370a9d8f3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
dinput8
DirectInput8Create
xinput1_3
ord2
winhttp
WinHttpReceiveResponse
advapi32
RegQueryValueExA
crypt32
CertFindCertificateInStore
gdi32
GetStockObject
kernel32
QueryPerformanceFrequency
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
ole32
CoTaskMemFree
oleaut32
SysFreeString
shell32
SHGetFolderPathA
user32
GetCursorPos
ws2_32
gethostbyname
msvcr100
?terminate@@YAXXZ
Exports
Exports
Sections
.text Size: - Virtual size: 9.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 18.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.string_ Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.guids Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
3DMGAME0 Size: - Virtual size: 129KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
3DMGAME1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
www.3dmgame.com.url
-
说明.txt