�?q��0�<�s(�)9KB�{�"�U�Le˫3~��[ �v���&�DA���r�0��G/���Cfw˽u��tk��P�f��{S�Ç���">srͦ��k/]��@["ۊ�`:��(�(.ADy����1��y��o�Xd�"��8�Ty%xC����?�����0: ��q�5˲�Ҡ��J�L�,ٲ6חu�D5�s���^��u�� �ՒHrJ���B�U�G�?�F�"V�A��Q���^TT3�3OP㺃��5�$A����M�����"��h�E E�d'� �F��q�*y民�q���7[�}W�[::I�ܯfdz8�xRe�>����G����Z��.�7@������V�`���"��������yb��B�O�ʋ#�O�ĥXnG��������A~F�N1�UMN��x�F�CY���<�0_t���~+П:������b34v���͋�7o�x5�ơ��>n��Q�є�\�Z}f;St��c �y`e(<[`�OB �� V��r{�ߥQ�S{���Wȏ�H�)ʓ�{�D��a��lx���½umAm�ˡ��MJ����}���f ����J�'A�źpeN���(�*��w)�@ � ���gű~�)��%��ľ^q��%w�#���`��R�P��!#`�Onf7�Ɖ\�k�k�R>yD)��90�Y�_�9�[B�a��縔G�2�b�8����g�\tq�ek���&.2W�M��u��O[A�1Ǫ���2��m�� �s|���Oe��"�1���=>�Q��:��B�>t�`_���_��g�Ӌ��4���-�X���j<nq���ԋl��U���뉇���Ґx}�eU<�a��� Q� ��&��%$;/�����@��g�"�jQ4x]�D�YA��3�҇hw⮑PE�����3�;�czi$)���B!z(�"v?������?��eX�9���a"��y o� ���>���7�C:��+�״�NdbX^�]jA�y��R��H���J�g� 6=��ɽc����?g����m|���,E�'��c�ZC@_���(�ʲ<��&���I������[Rud��WH�ͦr6�N0-�)G�fka9�I��D��9=�GdY� j��7�p��g����F��>���k�6�eC�"��(bxC�����n�n�D����f ��ҬF���#�;���\���!�H�����n70����;�$C[ ]��\��i\c���� ����Yw�n�:�)�=�!.���i��)kz8pY��Gp�<�ϓ��9����z�a���?��]jG�u4��JL����N�L��œ�g�����5����ԃ�����O9Xދ�$�B=QD&�??Y-���R24���+�������n�%�9�9�,�y�J9�Л� ��'��vfS7�V����3+����0Q0��o_zR����}G�Kߖ�T�L����e@�cz��Z�U��{i5����:�8����˲�F'��E�x��v�c����hP/} n*�e�IgB���eC��D�㼬%M篹��9J�YV R=ְ���A4SS�x�s].]�v�(���R�L7}�"?N�_���y���}[���wϵǹ��Eg�ޮW]-!����� H���Ǩe����>ӷ'dP������ iI���#�b� ��h���1~�]M��D ҮP3*���e>Ѳu�k���s����C���jS�q�*_b���X)�,�zU�3k�Y��/|낄P{s ���=� �X=!����y2�H�i�f\��|V��ȸqĭ�51���!�d��ăD�!X�4@6k͚���$�y5�-f-,�ȃ����,\,��~�T�\��ڽW�,��<@ɀCU�bC�3�զ�����߆� e���ms�U���hքޚD���b�r���M0�rh,"�"��"=彝'+�����mB�Ma��R0c���ˤ��nw��{���:�1��n��Z�M*GC��8��9�"l��:���"0J��N�n��!к�g)s�&֓3�HR�dH����h=��/��)�eg�F�|�����>��ٿ=wQ�zɂ��{Ff.���+>�ʽg�����H�R��1w"%[j��8pwC�c%�t>�G�9�xDIM��"k���U�()�X4�[l�km>�a.��a��jՆ�U����D@L����hs���p�w����B֒�MQ-J��!y�*m�e�����c��i��jgV0��&a�5Z�}[�q���Zźv\|%#�}V/R��3yh�<�.f��!>����ݺ�5�&q��g' ��r܄Q>IM��$�kV8�ˍ��Ѷ�A��������-7�mV�̃���oL�ԁ���;�"���Bbu��uzE�/����/u|9j�+�z�$�����[dC���� a�o�/`9��N��8fFQ�_�)���d"1se�`�|x�U�scY]D ����r�K��>�7P�5q�L2��5�R�=�-1Ū�CQV\K���V��&�*�%��]Y��p�0�������`6��VŸG'��^��ݖ����'�*�_+��ݬ��N�e�Hl+]����A�6�rVKn36�B�R�h@��"1`�+Lժ�����5G�7�j����Z�[��&:B�I�Qx�^ �m����]�:B�����Ѽ����G��(��k+2V�1�e�g�Rj�@z�Q#��F�+�R��p�[L��'�T�� ��T���d:�Пs�_ݽC}T��>�8u��"\^�a�7���w�`����u�564'� �1��֔ �'>&��Pp���?�:N��9LQ���}�Q=q�����/W� ���I<(�K� ��o�]����A2�� =����������������Hst�GI��"�Ar. ��/[;pF�k��v8�Ja2���6����j�9�Cy���jV�/�$1Zk�>���ԫ�m�R��ZDՋ�z��Ȝ��՝u�l٬��VV}d�N�[ۼe�8D��6$,,�P`�?���:#�0m�&ˎ��~�rR�e��q�ǣP_�p`�˓��j@�U:J��Nqi�4���7�5Z����z�`J�&��)�
Static task
static1
Behavioral task
behavioral1
Sample
CastlevaniaLOS2Revelations13Tr-LNG_v1.1/CastlevaniaLOS2Revelations+13Tr-LNG_v1.1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
CastlevaniaLOS2Revelations13Tr-LNG_v1.1/CastlevaniaLOS2Revelations+13Tr-LNG_v1.1.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
CastlevaniaLOS2Revelations13Tr-LNG_v1.1/游民星空 Gamersky.com.url
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
CastlevaniaLOS2Revelations13Tr-LNG_v1.1/游民星空 Gamersky.com.url
Resource
win10v2004-20240508-en
General
-
Target
463a27134ad4b020bbbe5e3ddabdfb19_JaffaCakes118
-
Size
2.6MB
-
MD5
463a27134ad4b020bbbe5e3ddabdfb19
-
SHA1
540ec3a3c7cf6ca7b57fecf2aedf4094aaec64a6
-
SHA256
0399c205fa74b3ed5f5606c6943951dca542ce038cf64cd595aa555e846d5b5d
-
SHA512
5d21671f6c49410ce92afc61e3cd7d3424118b441d0bd5f055a6a6860111dd7e21f8fc664c3b00056b245aa1c2ba8803819ccc0dd51e9367c09fade4a392af80
-
SSDEEP
49152:4M7xoRBhb4TQ2PbAfwkX5F18prdwq7PvtlYwk2kLLO4VerwQT7HsSJX5Psv:/7xoXhbuQQbA4ktArOkPMvO4VecQTFJy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/CastlevaniaLOS2Revelations13Tr-LNG_v1.1/CastlevaniaLOS2Revelations+13Tr-LNG_v1.1.exe
Files
-
463a27134ad4b020bbbe5e3ddabdfb19_JaffaCakes118.rar
-
CastlevaniaLOS2Revelations13Tr-LNG_v1.1/CastlevaniaLOS2Revelations+13Tr-LNG_v1.1 - I.N.F.O.txt
-
CastlevaniaLOS2Revelations13Tr-LNG_v1.1/CastlevaniaLOS2Revelations+13Tr-LNG_v1.1.exe.exe windows:5 windows x86 arch:x86
86e31fb10eea3f14d860aef256d3d800
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIatan
kernel32
LoadResource
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutOpen
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt0 Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
CastlevaniaLOS2Revelations13Tr-LNG_v1.1/下载说明.txt
-
CastlevaniaLOS2Revelations13Tr-LNG_v1.1/游民星空 Gamersky.com.url.url