�o�t꜄�ec���`�� ʫ3�f.��W�����洈Z��(�{�1�-�|@f_b� ���V��Õ])#3�;D1�8���d�V���ڛ��h%s�#��Z΅����i�A���G�w���R�FJmΊzl�rtP��$d��GQ.N�����#J�vS��uЇ΄��0��<��.HEY@��u���I1��g;�/��nrw�Sv��z�J&6�~�OR5^��I��5��lXj�jo9����?H��A�w�αC&��~ޜ�����&�G�DmIa'�K�xe�@Q�f���̪�'��*`��-i�� ����qZas�V�Yo�euyB�_ 23�a����Kܓ�J�&�H�7=]�� �"R�Z.0%ֆ!a���S�q�Z]ͨ�J!�_�F��a�lR:�?� z%#*��L�7U��(O� j��O��5xp��F�jR��a�� �Er������N��N��%Ԫފ�y�Nz\�P���Tؐ+�k�����H�fN���N���B�ٙ�\�yJ@��+��Ma��Ve ��ݵ:V����H���� �dtQ*e���pX͐v8����]Hܳ��A\�)O�������Y������� �i�'st��+�N� ��� �`�h ���ң��p�at,�����.���w� �(xQ��ə��~���4�Iɨȅ�B�st�̴�L`�y4�{�L�RJ@���Z�Ѱ��\��{ʑێ�CN cF�*[�n��oDsn�ݝv�C��JbQ��̣Gi<dW>@Ԥܘ,�+��?{G�;y��E�?�Pa�"�f��7#e��0�sXt�xt��`g�=O�k�¬�S�ݩ!�[���\i�mw�I�{ ��ć��Z.�R���;������{��Q4)Lx9����J��9�E�l�B܅1^Qh�̨�~�B�(.�u��ߍ�����Γ�ПR�2VSz,Qq��f5��^��a�m3%�S���USڸE �q����k����/r��Fl�|�j ���?7W[�o�DI�䱚#LG�˲0���?~��As?�3�nV��ּ�����Ʀ�A��%�,�+^m�E!����F�E�H5��a�y9, ���a��'�T �H ����)� ���¼���+��)�� �M�0K4y����v[�O�m�=�#�q�]��<+������x� x@#>�h��IM�67�������.���0U$��d=bʧ+F�'��l�r�Tđq��.�vel!�j���k�fa�ϼn������mmؓ���ƍ���k��4�h�ƻ�~�NwJ[YP� �U߁\J���D�P�S�Q�E��r'��ݪ|��!ϟ���)�N� �[8a�d�����yF�p���(����2zdB\����%���7�����sp�=n<�V`~�G��s����0/OφQ��Y�a��;o#�7�R�����a>C����I^��l̽�&��o�����E�=T���n��|Rp�rT`h9S\����h g�a��?��EM�A� "J��$�� ���C)|�,�9�"eBu���p��]�0�_�X M`�E�[�dp���[$�H]j_���fƸp� SKCo�d)��x�������#g��t��v�?R%`=R�в�G0m2`yl����w"j�up5mH�'�`�_f4s�,��x������ �F��o&�Y� ���6y�r�"���L8k['ҥ� � ;�L9�;Z�ة+�)t��c� 9�Z��k|x$��F���;,��*Z��7~�g���b�z��I��UX4�9,�������"���؛@qƲ��8m���=�L5�Ȁ��@�Һ���l�X�Y�����:C���.$�ad� s ���֞V,�i���=���Vٮ��Y����n�&�7�?!�������������Ⱦ���$sR"}�d�8֏�����1����9�0�h�ͽ�Ȼ`�_��D6���%z@ Z9������j�Ę���O.9�G�,�>��G��8Q�R깆:2i�"���|�*< f�7\�"T�H:��N��9�Q6�v��7S�w]Ǣ�����h)i�q�����c&�Q�W-�������t?ۦ!�3hW�ϷF"�|$�k����ًr�es�����vFA䓦�l8aQb(ϛP�!�)��# ��y� ����PV�0�5|��{Sj��Q��k>�;�f��J~�c,��U��^�o�ϟ�*[ �����O�s��� ���8�>���C[B��k$Ն�.� ��T�ͪ�b$��[ �+��5�B��q���.���gQ���@CV=.GOْ��A�(4��Oif���';�s����k��A�؍��0�*���q��k7i���x�L�X�~t�xfa(�N] ��������Ia�֮�u!�_`��`�AW~����7]՚t2k���]Qt_Ŗǹ��HއӋ�����jk��t��T�'�T��9�4Sz� [�vQ�g'i]ݥ�Sa؛"bf�0Brx�P�gp�u �R�<�s�6�����L�P:b�L(`Ч�27G�]+�߭أx�j��x��N�Lt%�ܙ����) �W\6��FkR�R½<F��R P8f�{t`$D0w��?��0])�� �ՂG<In�/h*ؕ<K�vH8�Ӌ;�{�����$��`�9L+]ec�M!�blP�P��t�S� �N}�>b��Ց U$�I�!�e��<jX���ŗHD���p.�x��e��Z, ��bT`���A���Lh,Ƙ������;�<�7M��l(���>��Y��zl�L���\k ���o5-sLU��/{�W��]��mzYc+T4z�P1���uf�7*V�������V�:$���V(��ђ�.��a�;i�v6��t54*v��lLl�bZ��՝Rr2���Պ䱫���\��ܱ=^�����3v�s5X8��g7�U8pҚ��F[�)�{��'�P�U� ˠG�BY��]w���d��������Ù��E�+ �9J:�jp�#���q��;Z�M:��HI���%���a�<�Qy(�өQJZ*C�+`i���FJ���;Td�^t��k3iC�fw{������<��ӟkS%����z��hs�
Static task
static1
Behavioral task
behavioral1
Sample
SRT3rd+20Tr-LinGon.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
SRT3rd+20Tr-LinGon.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
当游网-单机游戏门户站.url
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
当游网-单机游戏门户站.url
Resource
win10v2004-20240426-en
General
-
Target
978591dc1a2bec18534b862442ae697b_JaffaCakes118
-
Size
2.3MB
-
MD5
978591dc1a2bec18534b862442ae697b
-
SHA1
9eacbb98c550936537a33fe061df7bcf295dca0e
-
SHA256
bdcf24648dc0efe74996f60413e5f3491ce90d2a5de74688702c45fa087151f3
-
SHA512
58db3afcb2c3fdae8ae523a614f34bee221c480b1edc28470db138d63ce7945a39eea50771f0ad0295510b1dd2e8eb115fb39c4b265aca4f5cda0b4534c29ac9
-
SSDEEP
49152:4mAWroLuLhOyMjyqD3Olyb4T/fGHX9YeQM2gwNYzhnGifd:4wrovyMj5D+PT/OHNZ2uzh5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/SRT3rd+20Tr-LinGon.exe
Files
-
978591dc1a2bec18534b862442ae697b_JaffaCakes118.rar
-
SRT3rd+20Tr-LinGon.exe.exe windows:4 windows x86 arch:x86
d38c12a2a3a66c1a8a35d8eac8c76817
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaUI1ErrVar
kernel32
SizeofResource
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutGetPosition
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
使用说明.txt
-
当游网-单机游戏门户站.URL