Kwc���W���#0T~VW jW_�������'SΪ��dy�c���P�4�T��r����k��y�\P\�w�5轣}S��?[�N�ʠT��0��W�#ln��K����� tJ�抿D�z�H��1��������zz��9��qF믙K�v`�%$��L+�`�0�˘Up�o��6E�����F9]�j�E�����Ē�c�������&�9˰X���a<h>���4�Ξ��!��x��ܶ�ʁ���{�(�gN莹� ���I��&8s�U38��:v<Y:eC:��!.v�3��T�ޅ�y ͱ9O�[����_��).�a�-�����x�Ko�9�D�µ�8�H��P�c�\�;�G��`�\�a���at�ސ"��� o���R���_�ل�"@j�Q9$���L>��c0��8�;�&��(\��/l`���(��^�TOhM��>�u�[M,�}��O��/n��-���`�J�J��`f%��}d�c���GfMR�7��p�.U����~[�b��)�VIcD��7�t���0%��"i�5��xѲ���z-��+H8K�s�Z���0��K���]��L��A�$� �b�2����-�y�ڠZ��c��LY��m`���&�( ���3L�k�T}��䔪|��d%]��� �ҕ��8�gf�5��w�C���gxY��T�8���%��������q�~n� �+����$U�V�Q���c1`)��|MŚ6�j��͇v��6v����ݠNB�Y_�z��%�I����OF�EV�UA��\T�<�WgJ���迷E����Xn8�NN�(��A(��K�Y.`Re6��fL� ?ݻ-��E:w� ���������D�e�n�O�U_�������!B� Н���UK����9ߜ�ga~��C�)�-Г{5�\S��8���;lN�7� 8�8fHsm�NMw�(D,#�L�?IR���>�[��*�X�̼5dɯ�w�,y�x_U2��t� ���߇ 2(�؞3�iu]�Pt*��/ة0ol}�;�BJ#��0�H����mNR作�+����#�#�$������9>uĊ�� Z�.��{�5��m�)ۓ&���0�t��,���*�>l%1�S/v5��]��%��6�� u���md93�4�>h� ��x��n����[�gx�a��IJ>uJ�}U�^��?�Y���P�i@���v����xI>��@[�d9���*�0dsGB�;�c��fn��+K��5����� ��(�������%ZOL�d��s�����Wx}s���j���ܾ�p^C6��ě�9�(2���qz �����:�4%+�ZN�q�o�;?�cq�_�<�j��~����8�3�/RS��*V��ϡ��c�j��YU�KbE��q���������܇��e���� {u_�ؕ�i#� T,~$/�����^��DQR Pj��m���N��#ivv�I��K�nn�}��������>�|}����cW�e*%V�� �����cO�ٺ�u�Bb�+!���Fx�ޘ�Ż� {"�ֳ������Mz�5��4�o�R�����dE��}2 Ĝ�=i��"��������D�$��%u7 &{S�wЅdF��< ���L�9�^�XuG;bܜ�� �6M�5���+��Gbֲ�6�p��=��}�_5���Z;io�A�{ϔ���\��2��CR��-���Z#щ(b��;bڕfh~�g�-�Le��؟�ݛ�aя���A*h�@Ki�����%�ڠ�U��z�4C���E���=|˿�_~1v�n=+B�dx$�s��6E?��]�����|$��1旭 ؊=��?��{z��(�d�aZ��w�rv� =~��M���>��\������������6�S�<�䓿=�tdʒOi/� �YCj�G FG��0 U �=��U@rȡAD�%H ��a02��-����V+��\��z�y�Z��O��ͺt#���#�4����r�@�����^��Ӆ���nH08��a�����/�|e1ܞ�ef�#��)��r< 䮛��\�R6����g�{nQ�~,A�:�Z �����ww�^�<�l����aT��|R���3V���#�Ļ̺�Z�����{�X�?�]>W� 'E��K؈���b���Z�(SZucC�rX0��8�.� �u�W��m:��]�����j����P��N�ڜ�h��;C�*��_���O1�*?�f #kE*!2ʝ�Co �*���Z8]U����X#�'�B5��.=���c����!K�d?�Rg:ʢ�[��NU����� �� B?H�3Uis�a��������zd�*�����cXD���AKf��S�װ�.<:�n��H�ç��d~]��S`��.۶�:Q��OR�L������\�����!H=�a��M�<��#J�P��7z^�3VҘ�"FZ��r3���#���*���L���� �,�`O^�ȓx�u�]������$�����T'w�����~�a���tE�@7%T�DC������wID��){��'瓒�"tq�7�AO<KȠ$�g��uu;�hA�:z��2�{/���ۤ1���wݘ轥�V�(B ��ְ�y�nw��]�#4�A�ɹp�f�P�uY�e:@��'_Jl���n�-�(��8+̢#���ř���4�������8"R�߉�;���<h�i]�Ġ��q]M&PX�X�^�CQ:z��~�m�c�Im��m�+1����R��Z��t�{��c?f���/�����vjx�D=/�7!v��_p��Я����W�"�?��,Iw���Ab#'��h��X�Os�j��XG*a�0[��֘5WE�s�V��X>�Nnlr_�rsO ��O�Cy��`Q�R;7��S�X��J������B��/bd���N�}�e��K �1��{�c����kpw���]�l�Hښ��V ��Kе�pbI��Y�0(��,$�T����P��JJT�K��dנ�}F6ix�eq���_1��G� �;��<Q� ��3$�qm���M
Static task
static1
Behavioral task
behavioral1
Sample
StateOD+2Tr-LNG_v1.0.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
StateOD+2Tr-LNG_v1.0.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
游侠网热门单机游戏.url
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
游侠网热门单机游戏.url
Resource
win10v2004-20240508-en
General
-
Target
8552afbe7087c6827b6230034d98d393_JaffaCakes118
-
Size
2.3MB
-
MD5
8552afbe7087c6827b6230034d98d393
-
SHA1
8de338a8eeb34a97956950d761454b3f99ea2ba8
-
SHA256
64427b8230a9fe3300e338330d386a6e3d6a35248233f77dbb706552cf2aa746
-
SHA512
ebe02cbe5cfede30f4be71af9dce0d44a58d636b8b09d0f1f88ff8cc4a6fa5fa653cb57fb55794d473e90cd52faac7f159ad8b5c52251c72d5a621fd66b8e761
-
SSDEEP
49152:sQNjL0tLo6I/pGpPuzkSzhviuBJhyEcSLt0m0Nj/cBJbUssKNgJddQCIJo:sQ9L0tLZIBiPuQgviuB1B0zjYJo/tDdh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/StateOD+2Tr-LNG_v1.0.exe
Files
-
8552afbe7087c6827b6230034d98d393_JaffaCakes118.rar
-
ALI213.txt
-
StateOD+2Tr-LNG_v1.0.exe.exe windows:4 windows x86 arch:x86
504efbae96a2364af1cd0f32a7de0d1a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaOnError
kernel32
CreateFileA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutReset
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
游侠网热门单机游戏.url.url