�<1�+�y��' u��uW&pl����KU)ޏ��H2������\|�'8��7�ߩ��e�"woy�l�gK�rW�W����8�Q%{�D�#F��# ��h�����**�,Kvր<%�~=j�Kg�Dh�̷r�(�����^�i� *��q"\L�9��>�b���?�P�Ll�����V����mO ����r��۴#if} E\�˒}h��ì�T�u��^�����}� ���xV�U.�q��+�����[��G�V��� 7�{v�V��X&��t^zN���6���}�/��.a̜�g ;9��R]g�J���B^L���Gzr��(6�|��Ϗ?�g�V�B�l�x�FX���K)]ʹ4؟gBn�[�0e�mЛ�$3� ��K�����#/qUWo��6�$d}�������y�;��Ԡ�%�hk�L��9����RL0eͦ\�q4������-�}��Fm��ԧ�~����ey1��m���ڒ�."�h�_�#� �J�aL�IZk�.�qv���C���6Z��-����� {n8����d�����Ŭ��W��]2�1U}?�1`r����d��oZ�~�@?b���8߂6#Sr�vS@Lv����?��jʃ,������р�����;�es��*g?V��e���~&< ��Ҩ���;:<�7��'�@�K��GG��WB�AX�C��q/qM�ϣ�㤈:�UM4��e�W�%�U53֯n��mT�A�� -ru��~(y'�۷K#��;��͕��E�Z�tSH��"I���<BL����o�~�19ш�%��D7IٰbR���J|���t����@ ��<��~�Q��!�(��^M5-�&?�����b�'��Cȿ�{������^�>S�>�J��̶Y�v>��%�>�3�Z2Y7�\�o�C ��=X��c70(I.+�[> n���\x�BJ�=Q���m�LP�����%vz� ,��<�^of��� ���Pc���C�b3װ�q��)�*F�}{��ܼ�j�a�:$^t�} ���T��C��( A�uA�vk�i�+�"�?���6]W��_��½ͬ���m�i��Fߋ�TM��7Oy_��)���*X�#p�3�x?��6x��8`)��'b��rP]�&n�z�W���;?ɞ 弯`����E��O.o��M����� �w��*55��:���ڵ��v���q��,1�DBt4�,�y��~*�dsbPo����D�n�[�� �V�㗐�`ca@f��*�I���ڡ�mO��}�ρ���ݝ_D�r��������f4e��;�����u�ǴO^�-,� �O����R���2�ҡy�A;E�[V���g���x�Q�u8GG�{�YbW��gaA�IH� ڇ� ���>3 �.��.`X�����1d�U�2DOpr�d�G�Q���ډJ��/��� ����#���td�'���ʱɿ羥�.4)�o��3�ju{ڋPF���B³n���*&�S$���i��ef��?fl�*�&������-�L���P�8�ʈ� z�����pF�F�Ҹ�}D�|����Y��5f��jb�Z9��>���&��",Y|�����`E6�Ļ=���� �u���B�8-��C��6N��T䛎��aJ�B�6��+;��5�B~�})��e�U���B�.���{�+�0K���+:?3���t.N2҈NC��DC��1 �����IR.5!�~���c�$@��:Pl~Z���g�[�+jc����`����6Fu�j�q��Te~ૉh�<뫤�4��H���~ʸ��t��`���s|��g�i�6 J�o�ӸR�˫�!X�"k��NX-�y�]FBc����X|�k�[9>� 2!���Cwų�%�4@�Z�>���lW���oL;�2��(9+��.��x�S'\�N|�T�������6�M.�jR�G�K�2t�_�Ѱ�p0�t̟�@S�LTA�vԚ�λ>�2�j���C$����4���M O18�[�T�#M7�a �1U�w��L�¨t��w% �3ѫ� ���g��5'�5�_��%�QV�bg�q�6̈E����x�� ��%����Z�:<&��I0�Mz�cE�r�åx�S3�IW(8�?�H��U����1����!�N-�J6������e��C�-P刿�W�L��/�dcO�a���y�"�p� ��%�Q�>~3�Q�N�����n{��.��Di��{�N�K�L�;9Eq[J�:�3?p}ɴ����_���T�pFX�1"���D�cfeċ�� �DD8�f\/�����:1Ŏ���|Y�N�E� ��<=b����{�%Q&]�>Eu��8`c&�/7@.�'W�/��Cn�7��������ٗ:���[�6u�Ⱪ!返x fE��fW$��*y1[�i�>� <Z��G�Mp�xv x�- /2ŅDJN���/h ��1��U��k�rZTJc!#���<��~fY��E���2��J���N!�I�8�0:��|�OR^�\�N���IU���0��,�\���Y�E��f"�גR�� ���mqQq9����0,���N�G�e�n@ �!�e/�uD,�lK��So�t0C�_סW��F�~���C#? �H@�GMO뵏WŁ�˛����7�?+��@�EeQ����7�k�C��C�fф�۬B�*��j����anP�X�`FS�z��DA�x����)�$��p{�n0�Ba���ir���I����1Z�&���ETN"k�9�w�e�W�Uٶ6��d]�l�_����#�Uv�{�G_Rsv� ǘ1z����� )Z��e?���"6�B�"$�+�� �?ۆA�D�G����-I��!��p�O�P�O�F������L��/�0 ���C��pR,5�]�]��M m�<u@Ue���.0i:�2��i�J�� ���At@2sg0�X�0־5�G���꺲'����,��U|�_�T�-�7����I�-vi���*f�����z�Z5�R�7��T`�e^�.&4���-&X���5|�X��L�Pk=\_�K�,�U=
Static task
static1
Behavioral task
behavioral1
Sample
Gamersky_Crysis3.12Tr-LNG_HunterED_v1.3/Crysis3+12Tr-LNG_HunterED_v1.3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Gamersky_Crysis3.12Tr-LNG_HunterED_v1.3/Crysis3+12Tr-LNG_HunterED_v1.3.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Gamersky_Crysis3.12Tr-LNG_HunterED_v1.3/游民星空 Gamersky.com.url
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
Gamersky_Crysis3.12Tr-LNG_HunterED_v1.3/游民星空 Gamersky.com.url
Resource
win10v2004-20240426-en
General
-
Target
9d7fda990024fb6b4e06a1b938db5e99_JaffaCakes118
-
Size
2.3MB
-
MD5
9d7fda990024fb6b4e06a1b938db5e99
-
SHA1
e6a898c41f8db898b25c1015b99e3a3c3902a978
-
SHA256
d7aea015d53190b9a51bfb6d989eecb5a52881be53ec923e59d2044733e239e7
-
SHA512
375cb1c2e36f62f86fe8c0f29a3bc6bcc09b63acf466c996635b30d69aef9fd272add1fea644a7611a74cb51f953d3cf9fe3d3b7128dccc6b0f5f5f83452ed2f
-
SSDEEP
49152:8JKw7wbxOMfgQRFj2lSkXcI3YhPBbKI3ToeqgYQFMk+eg5j:8JUbxOGFj/kccQPz7YiMhp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Gamersky_Crysis3.12Tr-LNG_HunterED_v1.3/Crysis3+12Tr-LNG_HunterED_v1.3.exe
Files
-
9d7fda990024fb6b4e06a1b938db5e99_JaffaCakes118.rar
-
Gamersky_Crysis3.12Tr-LNG_HunterED_v1.3/Crysis3+12Tr-LNG_HunterED_v1.3 - I.N.F.O.txt
-
Gamersky_Crysis3.12Tr-LNG_HunterED_v1.3/Crysis3+12Tr-LNG_HunterED_v1.3.exe.exe windows:4 windows x86 arch:x86
6ea0d68864673b57af23447bea06dd21
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
DllFunctionCall
kernel32
SizeofResource
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutUnprepareHeader
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Gamersky_Crysis3.12Tr-LNG_HunterED_v1.3/VERY IMPORTANT!.txt
-
Gamersky_Crysis3.12Tr-LNG_HunterED_v1.3/下载说明.txt
-
Gamersky_Crysis3.12Tr-LNG_HunterED_v1.3/游民星空 Gamersky.com.url.url