%���qWh�d�J(��;�ʙ�ukjPK`���lw�����r�����.��h��P���b#ȡ)�; ���={���/S����Z6�^��A'��<��p�Z�F]s��!�@�BU�ȅ��,���7�ę���@���92]� f�g����vP�n=f��n$>�9c.l���ntO1����#��V���V`q�g���+��V�.TQs�|�֞����,G^2�T#�!;�+��vJ��w}�+�hz�7N�UM��� Z�aV$̟1����dF3r��Ш��@ND�whiU�:�� Ӯ#���u"��M��}yk�!�r�{�����!؈`���?��?���c��;R�ۦk�G�i���̆a@���V��AWSa��d\��I2�`H�N��d�^-A74�mbG?�8-��ȺK0��>�;�-�lﻭkw=�Q���|+�����TX�"��~�g���8������a�ռ_�V�)��uֱ��7�I��9!G��Q�E:�hC���"�1#'�_�v|�D�}_�����yL�І^/���5�^6 &��z�G��A��?�<���{B��g+�.��`�B��* ���7ar�(1�B��Եiwf�R�2�i���$g� ��J^�.���+mi��kN\X��6��p��<�N�s��$��]4�����_��f�Po����*�Z�1�C�;��M��� 14������$ j����S.�'�oH�d`��vv�5� �,��]����q�����q�M��iZ��\2M"ߵG��2�/�O�;��jA�����j��`d'�X]7gͭI`�vJ��0(%G�:�v�Y~^ �u�&�����&Z9" �K2��B���QHe��v'��Mf߁�,K��Y�m��5U$\&=E� ]e��r��[OW��gMP�F��C`s�n�%@�I����sB���[�Z"�כ��x�}q|}����/�:sv�^?��9A��G�?L��1_�0�6msw)<����pӼ#?M0��Kb1_0��iK�`ɳE<���i�.+�I��{�D�g@PT8"!.5�x��q)]�C5��鈴�1%0�����Y��M���V����(MV*˪ʟ��W�H�$u8��]�@{vW=J���Ș��XWv���4���~��h���,wUP��%H��c^�] S�^� /� ~�� �$��R%C���!P��O��?�������Y�|[VT��>��}[�#�p ���SC�D$�v�U�Z�Y�4��YV���P��Y�V�O-��l��Ht�!�v�����)���!��Gè�1LN��N:�:#`b� �^��z���h �#>c���բO�\jˮ� � ����^�X�G�v����t����`�G�씋�� {���>["2Մk\���N�eC\���y9��T��Sρ��j��X����v!� �`��!�P���!`U�e��ۛ�g>�g'���_��gfXv���ށυmٰh��i),_H�P�w�#ڪ�|wdosQ��om�n�^ 7uI>Jh�[f��8�CS\�w(��!��#Mc����-s�~��ޒ"ә0�!����yN��`=4�p�%�jxw����&�.u�����M[YEs4˽ �}�=�t�p�(��g����� ����`�*�`=�s,�/}��v���?᪃+Je^,l"�+.��|z� e�J_:l_Mݐ�Ml7?`v�d\3��3u��x�u0'�����]�Ǎ[�!A�0]}�خ�p��)0�W-F4�{�ܘ�ذ��9_�M��7!F]��c]��������*��%Eݿ���%� ���tŠ�lBm{jW�\��΄���۪*�����J�Ҭ5Ǩ���|���/ �p��M��6ƥ��S�]��:��P�\ӌ@3�8iL���-����ȃ���6�o����]T+�Q�L�9��BmWҭ�\E� �������Ra.�����w��^Qi�j�'�+�a}�J��� �����hV%d�<#5���`��h�҄�:r����OR6^^���lߞ�w�z.�Җ}0Tn�[:��)���E�;9�~�]�p���ki���躤[y����ac�&OS���ms��$PQ%!g�2z~:8����U��8'o��n�+j���89��ʄwu�p�J��sC5.�;�����# �#4T��y����<��.�)j��Ϣ[И`>y{9j���t�/NR�?E�5���4k�{�������nc��� .{?���d�<x�F��w�����ę���5���I*�EXMY%����c/L�C����ۄ!��Q�4�I��,�!����B�����1sÏ�n����'����A��� �o=�]Da�r�) o�{�?���y�:��a��WX���\�Fp�mˣ� W���@��(�Ef0�Ua��kl'��10��RK!o��*^�KI�6Ѩ �f��'`/,ǝ����_����K�������4Fo�X��W}��V#�膣⢢��zN��:@Nx����Ʊ�j[�JNdY$�d����<f�*�����|��KuP�V�@�i_�(.??�����X@�T$s:� �`T`��V.~-��~檹�0 >�yB�����sH�D��w���?�@��i-�@u��l��d;p�*Z����b�N�^�_�]�Y�mR�ړ�4�-H; ��K �y��:-n�V�����&��!����HM�G H t�l��Mi+�m2�n�0�R�p{ӭ-U����˾��,7�f�����(;��qfZL�"���B��2Q�k�Ka8�2Gz��4K��g���q�M~<���m�+5�U��@���Z�#{'�43�N�2.�;E�SmT�x�DC��+���{!+�@n�K>h��ΈňV���q-�W96}���O�:�0�ڛk��[s�E����яy�����Tw��T+Wm�t�1U:��Px� Q!>��O~A�%*��J��M:~1K"�e��Ø��'�^rK{��'�*R�5t�h��Y�~�|�^ ֥k��9N�D�,�F�j�c�p�:!b���M��K�3��i%�����5"����jlZ�-������תi��
Static task
static1
Behavioral task
behavioral1
Sample
DirtSD_+5Tr-LNG_v1.2.0.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
DirtSD_+5Tr-LNG_v1.2.0.exe
Resource
win10v2004-20240426-en
General
-
Target
4aae2e4950924ac5372d0c27882a4ee5_JaffaCakes118
-
Size
4.3MB
-
MD5
4aae2e4950924ac5372d0c27882a4ee5
-
SHA1
d7e985561a9663852ba721d900941ec64bfd4f45
-
SHA256
4d54411724e5bbd1375755176c1d9fc78193f1903561d41084fc7896b32da700
-
SHA512
36c99c42192bc3c87a6056dfa574b03a676986bec381501f57e7121b66b78643aff1bf0238271e80442d870de94ca7fa5335b752bbe0d481dd2d38ea493a83bb
-
SSDEEP
98304:teNwKxvqoD1LfpvENXgUuamqe83CHlb/WJlpWSk5obKzxik9W2oLF8:8FTLflE5gUBXe83CHlLWjtbaWvW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/DirtSD_+5Tr-LNG_v1.2.0.exe
Files
-
4aae2e4950924ac5372d0c27882a4ee5_JaffaCakes118.rar
-
DirtSD_+5Tr-LNG_v1.2.0.exe.exe windows:4 windows x86 arch:x86
92cbaa4d26948948587dc98a92416565
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaCheckType
kernel32
ReadFile
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutClose
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 954KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
VERY IMPORTANT!.txt
-
说明.txt