Ln������r^��G�]/��6�w��g�.t����љCZl@^ЃX�� ɯ+ݘ�� ��8����p�U�)J�;�bRP-P-���B��c�mi�Cܨ�����P������Hë|1~̚"A��^�3|ҁ����X'�4{+�"^0�F�����`�R-IK�X�%W|�B^E6�0y"��4+Ť3��I��9Ot��V��l� �=�g�K[�}7�KdP#�<Ƣ6E�i��z#l�)||!�ђ��v:^ [�9��9�c�:3��b��[7�y��O�*��0y���0D���|��0��d1�LX"�Z�kD&D�Wn���%��6�aZ�j ��-8s{?J�g�O7��J�W�ىY��KO�F����w�QD}���}��m,zLV�0��={��@\����p���(Uz_%%,�X�)�S�Qixv�%1�2� ����!d4eƍK��ak�d��d쇝(rmR�ؗ�q"��um�:#��u������!rZ#�� ]���6�5/��pOXVp��x6��$�C���6��ل�SUz4~��� � �Ʃ�iIp����m�ΰI��G�\(�1��Ӳ0�j��Z$��"��6�bK�!G�$v�[O��N�����R�ͫ|ػq)��U�EI�����;����.�u{C[B�<swbn�X�,��l�����)X��$ՖWA��}Ph����m(9��'NV;���.0V� t�m�.�ST���/;p�ŝ�x�����в��nlΪ� ��j��� �����7�R�@6���a!���,�"D�(Y:�e�F�[{�8���n�+D ��0��z)��J7�W� s����A�zJ���"�T��+���8A�f���6۱��.:�BDLs�0����o.�����V�')�M/O�j���S c�?�d�$3�n��K� �}��Cr�:��S��)kf�%K��|I]3*&E���4!��{ڸC]9s�����o�������Bm�&Uhb䇣H�eM��ҿL��/oq�;8<��]9�W��S ����m��7��-���|���:�I�������A�o�P�������i�k�ڄ8$]�����gh�YK�4���B�!�vؙ�E�2�IL���j���z��߁z�9��l�c�q���@��]X�1� 0�#Pt��|��[�̿�)�/�A-���.��B��w��Q���(`���8sFc���l�N���"+hСl<�42Qj�|��MI��Bn�dZ�8�BR�� �j. r����e�<����:��U�v:���a >��qT|�P��t������r<��@8�֝m�G�p�A�/0�ݢ7�B���]��#Rl|BX��r���0�c�9Œ��l���]��'��r4<�K�8[�P���=�4�>eoVMZ\�m�Z�%�����[h��#������%U�l��}U�U���R� � O�5��n�/���mr�*m%Y~�b����F��Ή"w>��bP2�L�g��5�Ԟ�>���EtX��)��N�M�o����d��jT�4��ZR3�GY�6#DZb���K�e_)�f8��0@~`b@��Ö��;�5���wmHTWnrW��s�����`�z�j/�] �n��R���R���`�ș�,��ǔ����';��>\��\��X���q3up?��˓\��7��Ζ���>�>�R�����@��P�,(�V`��|���%v���7%)���_[���c�DTR*���� E#�Z"f֩�M�-��4�`r�B!y��_���v�'z���ӕ �]���T4�u�ģw,S��ɦ�HwV������VE�E$/��T�lo�Լ��H�׳_�L)�XR�)�=��"Q �b���L��1��#$k������ʇ��U�w=��u� _�D���F����y�2�"���2��e���ۉ"l��'ʗU���Ͻ�I��;�s{��@C�6���̩1 ���"�"@��(̼�����,�^YI��3pF����W��0ְD"-yh�.����i��蟎jd�Ȕ����=��@9�9T%���������f�XV����>S<$���I����1T=�����݂��a�O ���c��?3&�!�����*�Or���* e��]A��Jv���m~�gQ�gҗ08SK ����O��ي �W��ߵ����n�`i�q����ˇ�J�S[p�[����A��V|cy���SB���#��]� F#�AY��q�5�K�t� �o"{�p�B����@��xeA�{ ��2jA� g/�.��ҿ%��q�X�v&�r�e'Ȥ���q�^�É�?������'-t�3�z�|e�[[Ō9�H�xn�v��������C��� =�Sp�Cq�c���Jj��*���v����F�W�Bd��o�V{�r�,*�v�������{���f/$���2��`E����\pKP�ힹ��H<_д�E��):�چm�C��N8�B0ʜn�d2y�*����9���L������$WLu}��;����%��P_=W�/�Lޱx������b˔�����M�3�� c�5�����<�����r�E��\Q��θ����X�5��k��ҏ�9��2�zJ���uak��7�KΌ��SdOu����Ü��Ik� �t���E��WL�0�y���wA�^���Zp�֍���*��[�_�e�4j���ۮJ�C� TT�G5_�_�ԇ��~I���hy�� ʨ+<��>DF���m:ۂ�6�-���I�%�v�����j]�HĻ���Z.��^���9�%����!3�` ��2��� $J0�����Q�����=��y�*Q@"����pu����H�X�%,,̆/� ��VdEdV��Q�C���?>���56r�+G\ތ�%j�n�L���;�%ݝm���ek�%�9�tL9)�WA����^�}� �!O7�}R��������-�@X�G/,Nv�wOO�}��z}���;���ï1Uy��se� ���G���Y�$J�/hG�J���˂ y����3N�#(I���M2RQԈ��WWNJ�!qk�V�h#��]mۧ$,e&�-�<�6�����]X%�f�F�� �P(��F�8�W���+��
Static task
static1
Behavioral task
behavioral1
Sample
gudanqiangshouxgaq7/AS2c+7Tr-LNG.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
gudanqiangshouxgaq7/AS2c+7Tr-LNG.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
gudanqiangshouxgaq7/西西单机游戏.url
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
gudanqiangshouxgaq7/西西单机游戏.url
Resource
win10v2004-20240508-en
General
-
Target
8349cf5d1f299432ba1a8fed51182464_JaffaCakes118
-
Size
2.0MB
-
MD5
8349cf5d1f299432ba1a8fed51182464
-
SHA1
fe487a960465a3c92873a1c0700dedd9b6033551
-
SHA256
a5764a2bc65c1c57a04bcad76384c86086161aa67485ef655eb19f3cb55322ad
-
SHA512
21fe4e4d19afdfe517636aa8e7b0c101bac8d2c6b20fbbdb26e616be9302cc850ec05229597cc6834d7685efd05ad686f6fd4f72f5d3e7ed3f0b11bb381ab349
-
SSDEEP
49152:NXINNEYIyVXotenQWS9U0AcmLXhKiQiMnPegpcURMB5vFwh:VQNvIM4teQLU02dKiLMPegaBg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/gudanqiangshouxgaq7/AS2c+7Tr-LNG.exe
Files
-
8349cf5d1f299432ba1a8fed51182464_JaffaCakes118.zip
-
gudanqiangshouxgaq7/AS2c+7Tr-LNG.exe.exe windows:4 windows x86 arch:x86
012b22e1d712fbd8a9ed40e76864a983
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord632
kernel32
CreateFileA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutUnprepareHeader
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
gudanqiangshouxgaq7/西西单机游戏.txt
-
gudanqiangshouxgaq7/西西单机游戏.url