�k�>�>Lu�K"�R#b��ı-{��� �u����ۢ��uچȻ;�l�8�:�� `�. ��do_�7ԬVA:;£�Q{�Q�QmP�R��H�ΐm���> ��P� ����]��s��9����)ͷ'�.���#�WF��q�/Q#�U�hS@����&ϻY���^�TEE��A<�l���[�Z�D �!�=��e�,�K� &�����Tk����:�惲�Ank����"ʯ㺫\p���g�Ǔ�X��v��ZV�!d([�3�B�Z?=[� ���Khۨ����*A���ܶ�E��t�k���Q�WsY������'���?�����m�e��sH�5濖�`�--g14�P��s2Nߋ(,������껝�#z&�_)�����H��MQ������PQ����p������y3A6$��z�I0��l��tP.$���1��^Yl�r,In��(R�:����kT1���HD��I�5:e�UD��_XC���P� ���b�g�T��G����b���L��i�T��A"�o����j�mWʱY����#�E˱�P�����ѝQ~G����C�LhU1���4q(ש/�`�6y�oy4M��S� �fDӮ���p����`�; n0(o��(0r�;�`�Fضp2�fek\��<��v�U�[t�����Lic��9#\BS��D�����~b`h���5w��З�Q��x�R�ȷ�m����G���%��=�CY��tv��m�$E��U���C:*k[e��w=���M��|(f�N^����"Q�L� � ��"�'F�t�b�U�к[�!Κ��(�t6"ڼġ�Ky$��u���F%o��ul����T�&wҺ, �+�Sc7o�}w��=���Q+�} x�ف�,����5���>�1����[m0�$�`��t���g��GIF�^��P���u��Z�C�J�4��Y���N/��5s��@����l�{�1[d��3I�ْ\a�U���`����������o��ϐ��N��1U#����X�5e�l���H+|c>�[�S�vC��m�fhP`Y=�C��{�dXb-��tH���3�� &�'H#�=�q����fo7�)T`dqۿ�a�VXg��9Y�pT"؍�5oR�Yعjp����"�z�k�M�e����(�(0_xwQ~�T�@{�}̙VU`�h��$����e�r���B�H�A�F�"ָy����Ӟ�҇��&�k�9ʑxX���pTbr<-2&O��ߣ7��}�F�H���P�˔�fo���K�kZA��p'��-KL�N�ðb���c6-�|>͖�0���-��Cȴ�,�S�fa�� H=�Dg�4D���<,���������ޓVdcTe��f�C��1OVN8-�9��>�VV-�:8�$�1����i�>;r��1j�m0�?�8��2XڒTSe.~0ͅ��،�(�W����A���,�(�0\Gᥤ��R��'�x�jR�rG���Q�DF۟����?�V���E�����8le��a�q�Jd=�LW�̌$7�v$�1!�m.8�d�v����3H�s��8�i��rq� ��2��V�*^��2̖�L�[��cy��?j=��~τJ�r��&BrL�G��A�L�՜M�/!����E�4?O�ؽ��z�s�!���>�����01�NQf4B�)pM��7�Z�8��Q��/������5W��JM��5 ����~^��o�k�кfZ ���ٜ"�A�%��Qd���d�rz �mT�~�a�.�{Q��i%c�@C��r\s�TI�ܬ?/Asбں��`�v�I���"�y�8ܙbK��g��ܧ�h�@;o�i�z�����x���JY�=<�3�S���#�c]��uDe�X��<vσ���L]�Z:v��z5���}�b��J3�����0� ˽��F���l)4Z��Iγ�3�%��h��^LO1 ��T���������pܤ���?E���j�����-�zy�a�{��͍$�sE|�k$1,([/� X���S��u0�Mb� ��"�����>/'�d��R�����V1�������:�0���uJ�'0.�Ң ֦�B���l7SC� :ᓀ_<p�0V⪈�y~��T�=3Z� |El��eHw�'�&�Ko���n��Sp�RC_C,e������߄����_����LGs\��� 9C���~"7�o����b�#��v��r�����;b�4hid�3F��-�b�¸Ų�W�T+7�~JF�"�c��%���ꝕ� �[p?@nX��R� q��P�����\�u��^�玙�K[e��j��[�冐Vr���(�)�Z. �Y~0�Yl��"��������d���8�g})r������+B]6����R�TB�l��=*�k�%Č�_d��[L����Yd��4��" y9��,n��X�=x%��=AZ2�Ol19|:��T�)Q�3�DC�x9�sz[��'��� .^"���b_��@�bi���|w��h�m��G#��k%o1����T"�y�LkP#�5���"X4iI@o��j��F{������:�3��"�i�^�f�l� �}|��F)�����q�T��i}Ӵ���0MB�ټ� -�֙�o��Mj���nǛ�@���`*�Z4"ϧ��g��R���Bx���Sպ��[i���9��e�X��y��JX�ҽ+J���}��� BQIa���*$�6���: qwd �O�:�2w��9͝|8�B������\?Y溦к�� �U%�"�C�?�`����%TE��_�h�K(7�{�3 ��7Y[��$+��/To6���. ���Xx�,a�8�o\Fde�t| �^���R[a�&8m���n�Օde�z���?NF�?Ӥ�.�������� Ua�տ\�+���{gann��g�e�����BA(�^n!�Q3tK���g�g�M�#yfM��U�B�-۳�gS�\��}2~��|kԅ���[�8��uu����(��cX������H�F�E<�\�����tJV�xJ�����"3�q�e���s;�fp\��+
Static task
static1
Behavioral task
behavioral1
Sample
2298/SpaceRangersHDAWA+6Tr-LNG_Build2.1.1650.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2298/SpaceRangersHDAWA+6Tr-LNG_Build2.1.1650.exe
Resource
win10v2004-20240426-en
General
-
Target
43554edf2c746435970abf823d9d64c8_JaffaCakes118
-
Size
2.4MB
-
MD5
43554edf2c746435970abf823d9d64c8
-
SHA1
f8573ec2bfa0371ccdac3c76df60ed81e869ca6c
-
SHA256
b24b6b9ab7254ffb6dd4b586249326d720593458fe723405fcdf8e70334672ec
-
SHA512
4278f09a542707dcdb7dcc4c37a4f0421e768cabc5588c7ce967c4319f67bfa3e786c629ef971471a63a05c273a2f5b3ae573c550db015789c79822d887e5420
-
SSDEEP
49152:YtbB2jbm5eTramC9VtihyBt8m5bikvZW6O1fswjW9Sv5PcnZRcw8Z/RTrEO:YtbB2HhTramGVayb8W2kxW1y7MEnZRJs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/2298/SpaceRangersHDAWA+6Tr-LNG_Build2.1.1650.exe
Files
-
43554edf2c746435970abf823d9d64c8_JaffaCakes118.rar
-
2298/SpaceRangersHDAWA+6Tr-LNG_Build2.1.1650 - I.N.F.O.txt
-
2298/SpaceRangersHDAWA+6Tr-LNG_Build2.1.1650.exe.exe windows:5 windows x86 arch:x86
61a333d9aabbefcd510040feefc509d7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaUI1I2
kernel32
LCMapStringA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutPrepareHeader
user32
MessageBoxW
Exports
Exports
Sections
.text Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt0 Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
2298/VERY very very IMPORTANT!.txt