�����)��lz�0�3z�tr����Z�QB�bT�7A��$Λ�Н���Ņ< ��}��O��FO�.A�2^<��4����O�K鞍�+�I�l-�2�G�ʒ�t�.��ވz�y�2�<O� BO���sm #�̗��������r��/m��7y)���ZxՀ�O؆�k<纚�$��G!�9������3���n[�Y"$"sg����f������$�z�f5䃠���%y�@9eZ��]�v*>�]����`�*�W�y����w��'f����!w�涩�mL8�"| 7* ۈ�2�N2P��?IJ�&�߃��� <P�\#���ү�}'_��N�pO��#9� �^@�A��gQ�h���#m� �Vykگ-���Gu#���T���U_��U���M4(S��7?0W��?�j2��Z���65�$�^6��f6 �{띛M��6�|[C�M-�]�Z�ϛN��TAy�A��z�]�z�FD�Mh�KI6��΄+3 A�N:� H{�������}n�4r�C��0kf��_R����9�}�5���m"V��+b���cp��7���YwE.ͷ�����m�B�\<^��R�>�wRкБ�q�#,1#7�XU'�]���Y�ę7��N4RS�� ���j�{̮5�}�6��SZ!F���; H���cGa�5�S ������D�6���fo�����+=8�~ü� �?��_�7W����l��@u*9)� 7��kGA��W@G�mYa8�I���I��ƾ�2�6�}�@��JBӅS�17(�2X�7����s��5P&Ǧ�\�b9��yX�Ј76�L�r���A�Ϙ�v�t ��y?=x�u*(��qR)�Q2a�����P��q�}����6�牷Fb�T�����ըU�� �{�:���8)�ON�.B5���S3w�u������ ������o��~�e��eT������Ŧ�{�hD��j���>�$45f��c��9�hukD�'�j������N}���U����\�-'���ų�<o��6���g8���V�����7o�ƎVq<`��9������V�ȭ³v>^�ݯگ���2 ������� -z4,!���"��I M��2�hW�`�d����M��J!p� C}T�N;6��G�R��_RvK��-�i� �^���*�L��5�f�C��BW|��������r��sԵ�A��6�U�~�lʹ���poZ����I�r,�'���y�?5?e<"����l���7=�մ{�����8X�W���urN]��w���>?}��h~:jO��UwBJ4�RΈ`a8����1к��wӛ�ц2�����#��`Pߍ��=r�����F)\���s�5�A�p��[�k3��0�]pH���&��T��29�`h-��"Tx*�DYw�b����-����r��`E�豵|L2�6p?첳��q�<Q"nN�Y��"$p�J�MV#϶���-P�e�R�T��zi�����pO�+����o�b��B��\����o(���s�{B�ew\�>f���Ӫ�u^ó8V�C��D�;��NM��ǥ��P�N�;�U�c�"Q���� L\���T�ʭ�Br_99�k;Y����i{��ʺk^gt}�}!5��!�ܾ;k��p]���G�_`�Ra���$��.�ZC�ky�d\X�k6��hI�ilR 3/ �M�㠿H�uV��? ��4 �=�KJ��9�j��ja�q��:�����X�� ��D#�A����>�ЧE�K7�G�|ϞN��⊎ߵ���x}����6�d�:(���ֲ$9`�(�V��..�'�����u��H�|�^��h��h�nu�p����K����#�5X�l���mO��uD\ݔ������118�����1SQ��}����ћ�\9�ѷ*p��6�嘝/�4sܭ���g�����Ls�]K2u�v7}���zf-�2�v�c`':@_Z���|>,�n�$i��f!0#��ੀ�C��f����)�'o��4Cаֵ/C�Z`�+�۹0!?+J� �W������W)��[mJO+�G[��qr�sPl�G4�=uiK:0���~x��C'GI�1�X �;�����"N^�&�rsO��!X ?}��[���p/��� �9�`TM�T��nw��Q^����dzU�/R�Q��1��j1�zN ��`�'I�i���!� �+���я|�BoK(6��*�+��A1'�N�)�ǐaipP��� t�֣��c+�Ǖ���h�V�����WB{Y�D�1s0�����4g�}n��h���(d�4��U~G���B����=�M�O�ԑ�`�Ԍʬ�'���]j�M4�u�-�Mn�4����X�P��a��u)����gaZgCF�nl&#Ͷ8��%�I������~t|��6m"V��� ��e���w�{�s�.0��!jƘ�:�QAJP'&�&f��,_}�Dó'y�?���$/whh����c �AP�L��'����woɲP�ۃ��-` �H�,t�1�������$+��g�o�G'SK!k�Qж�� 7٧��JD��Y U��mpӠ�gly�j`q�)��M^V�Z���N�8#�qRy#$4�`�dk�� �]^Ys�t�B\H�5�PA�㸳!.��]��P<��3���O�j� ��)v����9��Wh�DW/k�U����Π�Q����%P r�c�����dMH��h<C9 QL�7�Ҧ�1�Ai��+��w=5]���.�]����(��5]��sw����$:crK���u�q,'�Vyn��F��"��͊��"�9��<%�K�!��C�/��$��,���&�3��)��c/<Q@d�r�l7�;�K��C���;�v�x8�����逸����(��A�m[E^��s�YV{�� o0��M�-:��P����#U>��+���l �AB� ��]N������K�F����W��� ��ٻ�u�v����\CG{��D���i�.e ����,�,����YW��}��p���ˁ��{�;V�s�7 ^�#��f?p��v���JK�.s%W-�.�s�pz� �;���|(�Ԛ�����
Static task
static1
Behavioral task
behavioral1
Sample
SimCity[1].5.Cities.Of.Tomorrow.Offline.v.1.0.Tr.+13.MrAntiFun/DeusExTheFall+8Tr-LNG_v1.1.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
SimCity[1].5.Cities.Of.Tomorrow.Offline.v.1.0.Tr.+13.MrAntiFun/DeusExTheFall+8Tr-LNG_v1.1.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
软件E线下载.url
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
软件E线下载.url
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
软件资讯教程.url
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
软件资讯教程.url
Resource
win10v2004-20240226-en
General
-
Target
836ea159fe5d0cde718d8e8c07bcfab5_JaffaCakes118
-
Size
2.5MB
-
MD5
836ea159fe5d0cde718d8e8c07bcfab5
-
SHA1
d202a9618deec7540a428b46e9836974e9d86ad4
-
SHA256
7787cd411f802a0e7d8b02b6281e3d882a6d93c5f9511432bdb3178cf48da1f3
-
SHA512
382ec0074bb5f7e3f2d809e28c46d0ccef3adc32a004feacb526911a7a28eabc30f7bfc195e6ce862cac4635e60a58d278f0c256a3567c806c42130721a0aa09
-
SSDEEP
49152:kdmIw3GkvQupRpa5oLR10ximvg8dSJrYxdhxnnhXzYfclwhFG8ms:kdmIOGIvRpa5OR10IsBn5zkkmFG8ms
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/SimCity[1].5.Cities.Of.Tomorrow.Offline.v.1.0.Tr.+13.MrAntiFun/DeusExTheFall+8Tr-LNG_v1.1.exe
Files
-
836ea159fe5d0cde718d8e8c07bcfab5_JaffaCakes118.rar
-
SimCity[1].5.Cities.Of.Tomorrow.Offline.v.1.0.Tr.+13.MrAntiFun/DeusExTheFall+8Tr-LNG_v1.1.exe.exe windows:5 windows x86 arch:x86
386d46f2163bbfc2f95a316858765507
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord320
kernel32
TlsSetValue
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutUnprepareHeader
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt0 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
软件E线下载.url
-
软件资讯教程.url