����E��-~"��;?YcqW�t[C�*9�pF������z�<�L/"��XDB�(��5`�/���!���?]p`&"��.���g�M���O�{P�������]\�� ���,.��+�g�A|ru��l!�HS\����`���ׁ,�C<G��u��#�)� T��X�.��W})���C����t#E�Ye����8�����L �<�R�J���3|M�T~��`� I�����#58J��挱 ��y�e岦Ŋo��4<�����5aV��e��fr��8�5$ �[�/g��P�Ϋ�b�����SRdgo�a�3S��!��������yv)2��T�(�芜 DH���(�U�Xb���9輠��J���\:���=P��W��Q!�^��?���ir�Q��aa7�-1����B�8�o��G*�?F����`���E>�~ �E��z]�\�I���-�+�ôqxdμ�h�eb�X�rkq>�^����ȵ#���!cB+��R���9'Gr"�Qd��L�f�+�+n�;b�[�=NR�Q3ieV�����X�=�XE K�Lr�-Je;�ls=�n�C���q���R=/x -��5�r��u��_oF���$l=���d��� b{=����JT�Ī�ܳ�A�]0�,y\Co2:<<|1��H3^Cʏ�b��;ef&���p��T��k���u����ˑ`�-d7@>�J����ګ3�$��ڻ�폁|�Xdܬ� �խ��/]�nI����م��1�+M�o|��g���=5����)�%���ڕ3����2K���p���b�����7j���G�s��_�w����Aȧ��]Z��j�{��B���B���5��} �Lx_�a�#L��Y�l'�^i�-N�-[���!a���]� �AZ��0K�ݢc8���8��v`/�x�`=��q����?� |d��2�8��p낧`�Z��#%�4-am��EĢ+��Q^��5��A8�w�A��8���"�3�,[��_*(cT!����-��e���<���2+� ��݆�8L�7��Q�mi�h�A�R�=�?r�h�L�K=���Ժ�P����U,�����Д��>ɭ9�{���*����,E��q���NR�����i��%�#��@i�T`����C�����V`�:�R�"�@>�I 18Ҋɒ��`���p��ߕ�8�-����m[*�d�Tw<�~q[e�Si����\����ks��S�[���dp s����m���Y-|�(5�q[�.R\�z���,#���P�����t2�E]�?��>^� Ј�}^��=h�O�ಥ'J.l��'^����>��D�ۥj�3�4�����k��C�3o�t�KG5Hl �=�s�������5�oF�w�lV:[c`�)����;vI�r�BE��%� 4pV�Tc���%���1���t�d�h��C����Z���R�������C�H���}s�%� �h�h��T\��������"��z��Uα����D� �u�`30J��!q��د5�<���b�#���OH� ��9�j0���ʵg���O��h�Ù[Ӝ ��W�!��tx�(L�N@��-�H? �-~����܌ ��ӈ)�����i��0R�$/ѹIlKh�~��R^���g���V1v�EC!W5V�^�Zp�����j�A� �{7j�ر8���D��LZ,^�ZP`�{s΄�Ae3=:�ٜ���W�zl_"�q��s؏��Ӡ�WM��4tٻ;��?AϜ��2���u��盢�k�jF�3qƽh����<�S�⇏�B��x��� @ [Bތ�}�s� ��b�/�2`�Ld<n�~�� Z``Ќ�}��k�)�n������;y�za=tM��_ʧT�FY�hP���̘��'�ŭs�����C-��2 0�%lf���a���L����D��Ҟ�g~N���KX�ҨStw4�#���O��@y\��{3��O���u���E�E���N�ud87�{���Zv�Z��A���i�;�)�ukk�JN^ ;I��������&!� ]s�9V��ew2߬�}��)�n�a�A�8��'3Jݵ�V�qS�;�l�#��,(�=��H�9P�r��P�x� ���e�z0ǵ�+� ��#���sEt�g~����-�n����L��,�c� �����u��J`ZH�_���DO�����7 "FTUm�v��)k;�=S�<^[$��G�M)e�>��q�����fE�w=r�o%I��?�����Uz�,�do�����������H��Fj�!&bX!N~�x���O,�R��L�s�� �yH��~�����1��ß���3���Oɢ�����z��dI]�fC;��j�H��*�W��ˈ�D�����ݓ�0��R����1Y�J��18VqMb�\��B�ag��@�y~��%���[�6����W���Wb��iH�ge:X�%�E!�m�M�G�>�̣|�t�� opq�������.\��z�sU�qBZ|��������˽�XT���)�\td����z�J��� Q-��g���V�m���|m��y�����>,���/��6<V�ޢ��L?�� ёe�4��s�%�%���gv'.wNߑF�r�$(W� ȷ4u�C�T�������ʴ�J�t�B`n��P?I[{Ȋ*%�S����A[��"V� +U��4�[��S�2K����b|�)/��>!�Jx9�o�W���p�O �b�҉?�Z�}MX�qkZB(���}%���k]��s'�0�U��!�Clrp��#uΠ{�ҕ,�F��"-$��`��QW���/g�g�5� ��hʪr�25�^Q��,[��}�W�]�Q������Qmdʯ���������H�Ͽj��1�l��ێ�q�I�!6���RM�X�?����ܢM�, ���_m�x�h,{x��Z�%���[�Gs�*�����1ndY\i��@��CW9��f�f����-�aL�F)!�z�p�ۓz�q%����(!��vg>-8�bG�oῘ�>�*V\J��� J��a�z�($��~ ����\,��Y<�f]!K윳��߅/�&�D�D�H%�OVX9���
Static task
static1
Behavioral task
behavioral1
Sample
TCGhostRfs+18Tr-LNG.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
TCGhostRfs+18Tr-LNG.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
游侠网专题导航-游侠网中国单机游戏门户.url
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
游侠网专题导航-游侠网中国单机游戏门户.url
Resource
win10v2004-20240508-en
General
-
Target
97da9766c2fdca5fd44a6679867f96d7_JaffaCakes118
-
Size
1.9MB
-
MD5
97da9766c2fdca5fd44a6679867f96d7
-
SHA1
1a1c5c1295ea59618b106b8ab7f7b14ac1bcd221
-
SHA256
f99e02475d238f0cb05a9201151e2cc41d5959f8ddf6779b128435361a1c2fd9
-
SHA512
1633846496767ea0567e3bed26ce2acf6bc63e2b26062139fa7773142cc14b1e2da8b3228c97f34dff3f163fb86982a94b00bfe6ce44b1bcdee417c1d7e4cd1d
-
SSDEEP
49152:LS+mgw6THvjnX7IME29MriFBQ3OIYzymvRw5vH+AOGpdlaa5li9:Mgw6jrnXH9M+FW3HbeAO6l69
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/TCGhostRfs+18Tr-LNG.exe
Files
-
97da9766c2fdca5fd44a6679867f96d7_JaffaCakes118.rar
-
ALI213.txt
-
TCGhostRfs+18Tr-LNG.exe.exe windows:4 windows x86 arch:x86
afa07a6c20b58f8c4b80294847b093bd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaFixstrConstruct
kernel32
CloseHandle
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutGetPosition
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
游侠网专题导航-游侠网中国单机游戏门户.url.url