�%jӾtX>�]��v��,w����pF�� p;`[y@�#G)�j�Ftr� !h��g�{�uv��� Dp��ډ��9~ �v,��Y� �e<���������.]�kY%i�N�䠳}�U�o�!�%�c�_F�{���4_���N0Wݑ���� �Lol��E���$>��mZ�.H�z_-��GC#J�v���eb�!lT/z�%�S#:1�������2gѭv��@ ����pr��^}��&�{8J�-M����ga aY�Lnl��C0��-S�qc���o���/�Y51�vEAI=l�@$�P}<�rOh���,�Ysڽ���^�#(�C�#�h��J�;Jd(>���ޏ�q��d�k���-J �����# F���t�S���+�)�`>�1I��V��廌�.�r/P��}�ɫ{9^I��bʝ)�Uj9���̨��-�\F���4f��q����^�WG)��<(���V�����ɎJ�.�q�����ڢY��v��8��3Wn�O;��Q�)f��©�I"P2�%�� b��O�DQ�9K����(�� ���m�T���6=����{�/5t� �A�}�K��ւ"s�V�w��joT+�Ya�`�%�,|!������2�&�/$�V\�3��x�Ƣ�IIQ��kI\o(��^$oá�} �~[8H!i&� C�2��RR�em�=�Ү�a�I��s��W7��L���˃��б�A��u&������C�v%�]���F�� B{��|}J�E�B$ϝ��3'�H�.^�'Y}��r@ye�2�ՙ(ʭ\��XJe䟯AV�|f�o�wD^�pj�i���T9��x_�4�/��O��1+oz�G��~7����e��f��峳`x�̻�V�/G�&�]5z������a��9���z���&�盓����ĹY7�[����/��Bu����<�Q�X=������5J�>��{Nzә�Į��-���]~1����b�b��*��x����F�[0=.�%��:�=o������#vAfo�����E�����veF���P�!м��+(%��Dv3a��1�(��=����wsUFO/������z�{��.<ļ��w�Z(ߝ�\F�XA�� T���VLV���P(�j�LW=��"-�Q�a�f״%����i"n����Ri)��ލ5�a0-{��4��}�����ӭ^��y��,y(�R}|:�{m���%�l�2;�☃���E����(4�x�B%�tu���g�&n.�� ǻ�*ɿ��an���1��@7��Ѫ�fn���n�ʸ>�10��M?[8��FA�ٖ�ٗ��Nt�n �a$�3�Sź��zǤ*4�J�yd[y6PHܴMf@�b���[�;D�"i�d��0'>m�����C��G�(��~~�����t,��y��YA(��Q�R�vTQ��rp�;d�G���q��ޟ`b� �������C@@�J��� 4���x���F�A�$����N4�t��a"y�%D�����P�0�� ��- �8nu���XH(q茁YR�Z�y��WR�%M�Mf����݅'P�#m��8���EkMGX�� f"x2��YVLݑ3Q������� Ň=g7��莼 8 (���M��y��H��fV�r����9��OC�������1��4:z(���m�{1��:f�����gK��� �>;��U���ja,��v(/p[�Q6�-'(a��ַ���sW�I�. ��+ci{�N.�Vpg��D�Po����9@�jc�0�_!��9 �Wz4z��� �� ����^�w����dA�Ke������R�⢜��; ��� ���@�xP2�֡�F��<��8��%Q�jHG��l곞L�W��9r�����Ϋr��� �+#����+;�μnE�=����)�5�3��l��k�U�����;�ɊL\�{d2�s):�����U�/E�nT�=���Z@C�S<� 녎X���2�̌���*��2�e��������ؗ!��R|���>A�t�KqR�](��z~_�8�"=;*)��1�h���'*;���^�TZ�Q F������m��YP�x��E3�=��^D�9��ې-$o���X��.�)��a�o�>8�e��J�i�{��q���V���AY�9���}�q$y��gր<9�N-C/ ��2e����R�-�������K�C�NA-ڑ�h�2�N�"P�l�<��Uنs�á�'] !=���}�?��l�Y�-j7�Y���jTf��_$R�`�={D�fFXw��0�!i�@���i�EdUL�8)�!��a:���� �,/ �6���9�lO���I�'�W����x�������KH$(l0�h��4ֵ��ɪ�#j���l���(.���ۍ΄�K���H�����O8'ZąQ�?ys�<��oж����鸏�ڧ�ńPr��a��O{#����{<\�*b�5����DtP�AM�+H �� �U+�_E0a7�Żo?X�ޖ$��S#���I$�O�����i�TM0���"�u�ZK����v[��x�;���T��wf/q��Wړ*��Տt?$���Ʀ�On�'@xt�A�(y�^��RK��R5ѺMz@V �Y�ȴ\d��/�h��'�7=*�$�4�S��d�"�+{���V�d�Hu2f��M� NnD�9��u��D��� o�43��(zr�ܡ�5�1 K � �Δ�}��!I��՟c��� �{8��"��9���mȏ�E1���1��� �yH�����k��a�arC��u�\�r�JP��0.�6��ɺB� ����<hL�ΰ��Z�ԩM� о�M}@�ւ �˸)��/��� ��=��r?R�]Q���Q�!��qUw�|��2*\31R��)����h��I�~LM<a����<M}��N����{Yѽ�^�[q'?�ЖD���?���[�u����`����o��O��.�Auu�A�:k��-���+x�2CZ�js`���8��ܨ�J���j�����Zgc8��.��1�����+;f�8L�=h�Y2e�it�}t�.Ω�*]��]S`�A�`�W�wXV����$৻ O�q�N��]7�dφ5c
Static task
static1
Behavioral task
behavioral1
Sample
shourenbxstr6/OMD2+6Tr-LNG.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
shourenbxstr6/OMD2+6Tr-LNG.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
shourenbxstr6/西西单机游戏.url
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
shourenbxstr6/西西单机游戏.url
Resource
win10v2004-20240508-en
General
-
Target
6542bdcd46d6dd92e58bf805e9a7f433_JaffaCakes118
-
Size
2.1MB
-
MD5
6542bdcd46d6dd92e58bf805e9a7f433
-
SHA1
079861a3f8af4aab89f2cc3d5fefc990cc154994
-
SHA256
e35ce55de505bd720fbaf0692f2197e3540ff5e3b37782fdf07b0dac98cd819c
-
SHA512
d71205f34e0e63856941d9be338bab6ea24cfa5cb36648ea9e2c7a4f4a41ef0c6b0717cf23b32a4caf0a9ead1362c7fd33b2d5463c792797eb63a373f25177de
-
SSDEEP
49152:yQwY+bEI4KtfBLld801TE8vVSclo83tj1QbTsm5UioMz:ySKT5Lld8vsVvo8dWJXou
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/shourenbxstr6/OMD2+6Tr-LNG.exe
Files
-
6542bdcd46d6dd92e58bf805e9a7f433_JaffaCakes118.zip
-
shourenbxstr6/OMD2+6Tr-LNG.exe.exe windows:4 windows x86 arch:x86
89b683e41cc801dcd39b57a966e4e7e2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaFileClose
kernel32
Sleep
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutGetPosition
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
shourenbxstr6/西西单机游戏.txt
-
shourenbxstr6/西西单机游戏.url