ҼO��#�����C�X`x-�]���9Նi`����V�Y ��X��:m�OκޡW:�F����Uŕ���(���Q&��N\ڳ��8�H`*+B�ڛ;����`����t5������ ��zW ��m-�� i�^L9d���S�z����eC؝�Je<��5��]�7K��F�i��5�� G���4�.���#�b8ok�n��@\A�gi��:�&�@1j�EQ��~��<�6]��r� �g��t��I7Y+��Lf��)|�b�E~t����%��R�3�����[(�@�r�������+�q\ �m����a%d�Ǻ5:��~p[��_GS������� ��缵��3�|�@�yۗ�V����\^n��Ǿ�D}Eۣ_�r ��fTr��#a7��墿zWgp`��[r]];w��!�x�zq&�;|��!%p�0���ʰS���6P���{�1Z7�q��2�����K�w�hU�H��÷W�~�{S~�����0�1~B �I�qϧj�)�U��1�VL���������b A�����E9D��,��O^�0@ØdG_/Q~�U�Gro�9} s�y9�����c�5�!� ��tAp9��SW�Լ�6��uik(���bҧ} Fi�а��4�M�J��Y1B�V��]�_�j�����>�����ﻛ����w��?���6�y �䤃'|��C|��ޮ|��|�!ʣ���V'\����bJX2*(��1�:�;�0�UE����F�I@���X$�B����[�F�!�w���mQ��� s�by�������j0�����.� P�עT��� k�S���ڜ�>{��F픷w��B�\�� kQP�jvHz�zc�U�r��I�E���7�:.��:WD<�����\k�3-���H��p^�tX��ۭ��AJ�����?��]?���֤F̔]�3�����|\~e��%��]C J����IT�՚������k %3pzw1ܱbJ�_�K%Vr#��t��X�ԕ���b���t'g�-��<2b;#� .W�r��Az��21%�:��� NWzy���'�x��H�HpJL�.fn����'�57�sKO��:V�<Y�j�2|M���V/�É{lnA���������B��z���K����ݨ�� �c��K0��^���3�SW)�pn���V���"K��7��ZXz/��䒆sc�S ��w�;*��H���yA@�m@�ҍ@�z�t��m6���Fm�uNk�4{�a�����YJ���f.��rᝂ��<g�V( �V��^��l2_A!5��E�u)�� ��4[ݝD�;���UWq�����ֵ� �����G#�mwF;=�LAk� ��fF1(z��ƾͬ_�Vy4�rЊʌV���G��RQl���������U3�P�h���Oj�����g�ƚ�[\%{���sbD��QbC[������0k�_��0'+/7y-Yh�`:/^o-�=�-ǓR�� ���Ѷ}Na���*�3]D:ê��$�̽�&�%����{, �9��5��.|PZ=O�ZQ�[d�����r���M��9g,��~��%u8������-�aS�R�g`�[�XK��tm�J#�����K){�vá;��"_���_ ;�`6�?x�6�������O��eUm�j"��6�L�=�^.�M^=�PDV������\�!9�27���'��1�S���0 C�ª5��},�J�o1����3cF���Д6�����/�NQ�~Cft��N�����,S9AC�l���yX�'�kD���� ��:;{�&&����<�<{=7G���I� �u�+�H6�H������D�W�"��ʴ���*Okz�L�I>k�J����bu���p�/�~�P�b<�I<~(������)�v�?�X�9�G%� }�eY�E�8��pꎘ�&��Y.�C�p�Ŝ2�eS�Z&����U��,��U����zx�!�Z��f8>�:)�r�+U3F��J��T6��������J,4>#��??��i}�C��>����� }�_�b��7KQ�����Z�T����0̱�4n!�6��*VN�.8�ӗ�1��eᦄo���RuD�G������זqSs�H����#�R�~��?����m}y�}&�8�YtL�(o�-U��VI�Y��=w��ܸ�""�9�i��7C���Z��z���J>s{�<ډuݧ�{�iV�P�Q����KZ"���.��ZN�Q�0v��-��#G�O��40�-8�ðcT�oS�qʒ�d �w��\QX��U��$ʟd��i��4i[J��v%�k��v���|x��X 9��Ni��p4���.�q>�Xŀ3��o�ϔ�\7^';����������N2�(�@��r~?�g��pvS��Y!��m�M�g?�V�Y7㕵��ü����q������Z5�[� 6SB��cv��(�/�6*������+�=�k'H4�@�pg�^�6�Ӳ���?{���K@���-���<��-Vce�k�������_���M l �aFŚbFX齶��KF���� ��e�L]�P�Va����:�"����`���u~�P��ɘ��=���g�W��ڄI՚�m֎>q��Rr4fr$���*W"�H¥�8�d�cӒ�,�X��.*r78�i�>�sc;���V `��|s���_<��9z� S1�Q6-�'-d �NCD���|�?�n!�� 8� (I�����/�my��D2��&[H$��t�+ѹ��٭������ӌ� ��[:]5��xR�M��:������*;�G"ӝk����Ѡ�7;�I�'[ &��9Df8TF���(gx�T�`M�sx�� ����?~�L���������V9���o{6���+H����PY�?8;/�����訮� Aܥ��,� kC���sS`]�. +��3����@���H��-C���s�A*H�V�P���Wl9��P���;�Ll�'�A��-d'��~W'vX |�����~�4j�)��P�~��m�d��9�L=q0��CA�4�������n�u���Ł&��4�6
Static task
static1
Behavioral task
behavioral1
Sample
LLOTR+7Tr-LNG.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
LLOTR+7Tr-LNG.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
当游网-单机游戏门户站.url
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
当游网-单机游戏门户站.url
Resource
win10v2004-20240426-en
General
-
Target
503f112fbe363175f3e601bc8453ce0e_JaffaCakes118
-
Size
1.9MB
-
MD5
503f112fbe363175f3e601bc8453ce0e
-
SHA1
aef4272d7532bb775df4520263088cb14341e376
-
SHA256
2a18ae62e92737d4bd42f94ace0399600274ac42a7e1c15339f2ea0bc76b859a
-
SHA512
6f450fd7a95cae145598612c885bdf5be74164ca7e0b7dc1f4b5238ad1b1676b085f5c8f98d6bd91747d90bf06bed0cd985fb8e9fd872c5d155c27aba417ba33
-
SSDEEP
49152:TJLGgl8DZ6/a3f+M+dRSoav7MpQNPRDijnm/:1LeZRfj0avB9/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/LLOTR+7Tr-LNG.exe
Files
-
503f112fbe363175f3e601bc8453ce0e_JaffaCakes118.rar
-
LLOTR+7Tr-LNG - I.N.F.O.txt
-
LLOTR+7Tr-LNG.exe.exe windows:4 windows x86 arch:x86
3638347034d4a9b96e3c204a9442bbd5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaAryConstruct2
kernel32
LoadResource
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutGetPosition
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 962KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
使用说明.txt
-
当游网-单机游戏门户站.URL