/ki�5�^��r<���ވ��֗C����}bwj*�7��0<�,�Z����jꒅܣ���>֦��H�ʒ�5uڈ�O�5\�x��c�N�ŝ;t��js�bZ=u�bk��/��>3�p�l�?'q�(���ߖ;�;[!%�Cқ�� �*�����u07Mu������+��Cා�H8�J�]� %<00��ɓ�Z]��;�^ :�M�����Хb�$�Ch>����NȞT����G�g��DŽ{!R|���s�W�e� � �@��Xnޞ�1���[,��4)8���T�&�}��� Q�9��"��{�R���pi"�(k��E(C��\�f�j&}�]��S"��P�é#f��t����J�qh�E�0v~7ʐv$�V|tY���&���_�����ɪ�t�jD�v��F�D��?��i����g�dSn��Gf�1,n�QG�5ZU�5#l��u�!ve����e�Ԃ�8Kj�� �}�Q����/���7��fJDz��V`�2����&؛D����79��@$�An�d��0Ym�O3�mls55<~+,Qu���-&�+<XB7U�e���ӌH(���㵎̶,��}��{���<Ȏ�?|��"��L�3����y�����K��!�� Q<�����j`��x�aSi%���u�Ts��q��C��k-�S�z�)���w\�u)���Bjz���䢤1�!6���Y.��*-��8�ű�P��iYQ��U]������NR��Jm�;4�Ze��D�G�� M*l!c�p-��s5u�N���EHY��t�'\m�"N;P��/V�k���@8�ZG�_Ԁ@���0)y>����������������qي_�|oQ�5 ��K��s�'���ة��Ȩ�b��J�h5Dq���%"6�a�@���V�7}IVG%Lz�T`���/,�zO��Q-�Ҡgx�w����0k#����ʪA�jdqrur�7�a5�*y�s�^r�^&~��u�`�+�ף�;��fx�aX�m��㍜9f�T�ȒcN�+�����h>:�ͤp]y��9�q����םA��`����|��R�d�ީ�n숪�;�tA��-_B'���m����V�$]�_5+�m��,�B:W\����f3 �e�d�6I��@�K(b�_�B۬j2">$*����]�b�w�(�vJ@<K���x?�J1���\v0�#f"�4Z�A�nͱk�'�*��Kl&���n��� �����X����8� #8��w����Lɩlmp5�)��A�`OoW�2Pº\Z�.�WY��<���bq�lig�Q-�i��OՓ���P�+�P��)JQ$9@�*���*�/�+�X֍��3@'3QL4[{X����S�7����Ĵ�>j|d�}@���3�j�mJ�0)�Y�� ��!�Ճ�<PA�������)s'�-<R��(�h+0o���-*�*SkD����h={O:��ȳ�8+^m���ϓ����v�eF+����eSr�m��yÐ[~}���{��-ٶ>���ItK�ˌc-��4UҮh(N���r�=�9b{�jaW9 #z%j���:���m�v�3bkw���,��;RU���^�����&.�=�m��)�1Ī��#�����+�Qᢳ��(}�W;U���3�z�>�����=-�qh�����7���9�B�� k(d*�V�뀝Qq��J#���0Ymi�ќ� J0�B�a�g��e.k5Z�5�+�����GSY�.�i���^W�x�46`�O�؝��}�m���t�ע*��}>���?�+��w�'�d7g�|��;� Ʊ�M ��<� ����S�G�5�� �"��:��)�w��E�g�����O�� �%4ׇ���:�f6#���Sk̐�!�Y�?!iL�ms� ��������?��'��Q������b�4l��!�1�/��Z*��ni��B{f}ǙmӨ֤ô�?������);� Ob����ꆖV8oFM����f���Q���K ��/��<�~��ʘ���}s��� X%�x3g�j��AO�C\G�+cU�~r���6���E~$ �0�����u@�S��E�2�qJ�m�:��=���-����+#^�'e��ge�R��R�ؑqоݧ���,��\���G�:m�נŘw��倝o &cϣM�n,߈1z��Aֽ�b�Nl6([�{�\�a�[�jkH@�M�N1��Ŋn�߰�(�����,���DΎ������p���k�)��J�cc�Վ����ۤ��ʩ�D�cpU���Qso�����B���������]�i� ��H���2?�{�}��.���������x �� �����R�T����oX���%l�>٫f�d��j��N��'�����_�s\٧=�r�ΙU��������D3UY��ķ�F?Zi0ݣS�Et� ���w�����$�(��Eutt�&��CK�ݪL�����v?[���_�6+3�D��z�(Y��r����"z�rW�-,��� Ӟ79���.�� ���H�צ8-��GOCh0�bS��c,��M@m�0�#+�4�c*"�"#� �yy�ׯ�BА�9��l�e�;�|^Z�ls�op����/moռ� ߸z�ͻ�Y9s��o�M$�p�P ��z�x��K+rӚ�ugs���u�a� �h��r��XkkI?�7��UR�4��6Hf��Y�4_t�h �m*��qj�稏8��<����5���?���?�)�ɐ�B(Q�iX[R)�m*�'n�>��P {�P;I8�o23j#�ʵk~ö`N4pń{ �\"`|;$��8"�4 ����v3����Ɠ�������������N�J�;!炖/����#����˼�(����.�cL����M�C�bPY[0i�EM��i}y��T��NS�+���<���\1˖{*����c"�}Ղ�z�?��;N�� ��Fu�Pa �S����T�� ��"��˹5��1���@l��1ʴ1Ԅ���$h�&B�ٰ�� {��RQ�[;�<�n���6��zk ��H�+H{OȌ��[��|���uQrCu����"�J����"��-��/v"r$>˼���
Static task
static1
Behavioral task
behavioral1
Sample
3DMGAME 中国第一单机游戏门户 全球最大汉化游戏论坛.url
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3DMGAME 中国第一单机游戏门户 全球最大汉化游戏论坛.url
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
SleepingDogs+5_AOBeta.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
SleepingDogs+5_AOBeta.exe
Resource
win10v2004-20240426-en
General
-
Target
414151e1dc08abe884dd27bcd7ab34bb_JaffaCakes118
-
Size
2.0MB
-
MD5
414151e1dc08abe884dd27bcd7ab34bb
-
SHA1
c5dfe464ce50316ca14d8105170bcc0fa55db760
-
SHA256
3968225aadbd511a5382152e0838894f519a3809e3fd68552de92005fb95f904
-
SHA512
0b0396ad9ab831c24852ee4b9915ba7d6423b7fb59fb1486b74fd4bd0a2937b48e76ffb34bb5d6001c9bd8d3cf5d596542f79338bdb1d5d3d8e57176f0a522c6
-
SSDEEP
49152:fJfxXbZvKQxfdAisBKlujySwkOL0MIWfKk:fJfxLZvKmfaLRjy79L0MIWyk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/SleepingDogs+5_AOBeta.exe
Files
-
414151e1dc08abe884dd27bcd7ab34bb_JaffaCakes118.rar
-
3DMGAME 中国第一单机游戏门户 全球最大汉化游戏论坛.url
-
AOBeta_Info.txt
-
SleepingDogs+5_AOBeta.exe.exe windows:4 windows x86 arch:x86
cd137ac46c4bade82904276ba4745913
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord526
kernel32
Sleep
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutPrepareHeader
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 27KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
说明.txt