k`^$�����.⸿X������<#�er�L�y����#��Yv���3�h�2����6�p�u �{\?��w7���ޛk��xl�Sɤ|�(���F_KK �3�k��s�?�:]@;�'��ڣ��BL�>�e��[�Fw!� ��#�L��ۋ>N,� �t�r��>p"t̸&�{��%�����9�<�����.Wr�iƠ. ��b !��1:�4��o6?] ��=��L;��de}�cls�<�� ��˸�b<��+����nn:-�Rz�X�PN�ޣD��L�O�C�����S������S=�G��% x�GN�82T�Ğ�Z/��H��*���ܝ^���y� ���k��H��,��;7� ���O��u�b�r��S�u�J���pQ�١��ہ���������"ε <oǹe��GВ�m�z�n����d�;b���Ӏ�����v�i�����P��%�}�#��(�m]����##oD��7O0�e�v�M�iZaKΐ�K�:Ce# h`(�0����SB�FC��X�7�n�E�rs�a�����]�t�߰ٵw1n� ��1P/��a�t��b�x��^��8G.$Лg�=�+���ۂۅ�|ҝ�X�bU�[Ck^�R����2����7��C���s��]� ��i|+&��~=ܸ6���� xX�L֏���E�s��*��HQp\���c���iN��;*�^!/�Nڔ6U� 9i��696E�3����) ���T�9c��"�u��� �)_F���+�y0�戶���N��z�J�Eo�����*vKOF�Vn��@y���YW$Ї��.΅�<�l��F�-���K'�]9�$��w�@/��a�ێ��3�~0H:Gn��.x������ް"8eɵTo�E�qH~c�='�^�ִN�m^�/�'���h��H���/1� 9��P��\�������~�9���q� ��T��C���ڬ���4��)� ����'�$ؗ�����Qk�ʼn㲒?���~b���HV���+_GVi;��旐i5w-���|9�<���̓%L��a���eZ�D���e2�n��6N�;RJX'7�f�pf,�Y��m����M�)\k/�g�1�v)E��у-\���S�u�����hM��`�Zw�%��.���GR�����)J��RD<�}��|�U��vU�rQi<L}6+p�Zu}#�����Ȫ�R���PPi��:�}1�^�d2#<��#]]��%%y�؉`���s�&s#7�^��M^%�����갫�=l1��86j�X��g�e�`����(!T%a�#�p�[�#i��@���Ō�o�~n�g�~䧕��#;N�f��A�d�G�P~�vK�9�KT��(r�=%{�C�����}1������#��&��,�z��+�&�8-�M�g������H ����Z�,�y(V��i�P��s5�[%��;��F���)h�,�جx�s�*I�$�ő,ͺ@%���O�2�-���J���HQ�F����:�e�{ h�h�f�9���)U�i���]����0�%���8�Qg��%aT��-I�5�.W<$�a�G��DKH+=��#�wd�e�L�MM�6_������}�����&����^����T�=��$mg�W�㬏��*�!����GG��-HP�3Q�i=���t'�̓��M��!���'9m����>0�HգS 1+X�.�m��)��G�������n���~!Y=>~YH��Ght���b�-��TO�A�m�a���p� 8 qށ���¼�9�u�vS��Yu�@�eߗ�C,�O�Z��}�Aiَ��� &i����lo����g�xh,���/���@�������&��&x~)�R�&�CT��ҽ�i�D�']�#�C�)�4w���"�����)AX}����9��!�\�3_�EwH{��3�^<kƻ� ��+0W������Y�C��{;M�����DN�qW�k���T��{�0W�SOB#ߜI��q�`��n�*�b3^36���X]s� *���L+�)���l���=�N���1���j�>KV�fd�� �3e�j �X�Ϥň�¬?���:�Hq5���F�2o�v gaz?�pG��{Ɩ��hW<(�@�cjb��2C��L)$,�fK��P�롗q���O�-(Z�>��}B�[�X�@Mzǰ�|]wҠ; Y��H�rMn{x@�}r�4s��%j����uE����@��c��2f�g�Z��v�zt�Pc4f�>�?���S���N=p��-�+J�g�Wm?C�)s����o�~~��K �G�.=`�A�{�^iD��m�I�f�x8���� �z��@��v��g��Ck^{�ͻCl E���G!T�x�0�ԬSVL�K۴�}�+3�4�L�ܕ�rո=��yΜ���z���e�I� ����i��K�ǻ��&:�է H�?���ݢ�uŀ6�$��0L���ݳ#��8����i��VC���)S;x���=q�ɟ�|��t��4ZgW:)yk�w�b���E�Vy�]�W�T�w[���]�Z�w��2ZoԾJ��������ۧZ���״��۪�C"�9d+�C�c�t���J��Q����R���?]�"r�_j�L�Y��z� ���� {i,��l�rvI��ƈ��ɀ"ҿ�f=5~)��8�� .������g��i���>2aG�(J�B:�����i�~IVl�ڸ7 ���уl�LV>>�+�}Z���q�]���5�4��H�' ̃N�{�2�Qc˂�ʠ�n5Rod=��#bv�Q9X~�K�[�p(���S���U��b��G��v�筒�Q��|��ULC}(� ��}�dD��C���I,�?���b��*3���cX%w�Xv{O~�[uz��g�}�/�����GV���#�������?�i��(�I��d�<���>�40��E�y���~Ov��a�7�֕���4����B����p9�kl �@��x�/�kt�h����XF���k2s�Q���tɒ�.V�66�S!�U�/H��V�r����{ ���l�|=ā��3x��\��a�q�u��f pvu�,
Static task
static1
Behavioral task
behavioral1
Sample
ME3+21Tr-LNG.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ME3+21Tr-LNG.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
游侠网专题导航-游侠网中国单机游戏门户.url
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
游侠网专题导航-游侠网中国单机游戏门户.url
Resource
win10v2004-20240508-en
General
-
Target
50ee558d79066e05da8924838a5068c6_JaffaCakes118
-
Size
2.3MB
-
MD5
50ee558d79066e05da8924838a5068c6
-
SHA1
f12ad3a64ccdac3b9fafd265aa4a2ea9564449cd
-
SHA256
82ab9a459c07d644fba8dc230825d10b96463d79cb54f27daf6dc34f9927cc39
-
SHA512
3ad79472307f8d3ccaff4e30af1e07b2e597a90f140a5b2944d5594b68aa9da9f844546921ca79f08fdd457b0bde6bb9ff4adbdd6c52000222b2b695bdd5f73f
-
SSDEEP
49152:qdkRy4ObKk48rnsNYqeDrKIg6cKe09KRKA6tP7S0nNUezrpIak3:qdp5bt4hSvbRKRf6tZ+ezan
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ME3+21Tr-LNG.exe
Files
-
50ee558d79066e05da8924838a5068c6_JaffaCakes118.rar
-
ALI213.txt
-
ME3+21Tr-LNG.exe.exe windows:4 windows x86 arch:x86
162921cccc3eb3cd1af195fe846db8e9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarTstGt
kernel32
SetThreadPriority
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutOpen
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
游侠网专题导航-游侠网中国单机游戏门户.url.url