8���$�YSZ�L����$ �G�u-MF������(u�c�]e���&�9������z����S��Y�cBA���dY�q�8faգ�ߊv�)�V�8���Q k'��������3:����g��_ox�����vMq��0]oG �왏VL��U�,����c (��@���!mY1s<�,�_�0_(��?�`YɩrI{K�g'XQ���G�~��Ď�3J���r���JJK����u��w��~�3�H��)�a%��z\e:bG@Qk�h�괽k�Z|�,����\2D@����/ ���*��(]s]@������b7�a�h"B�J�F�#O��_2|�]����db����V��H��e�k}"�x\�k�JqkH�C��_OAq�@[k8afm?d�-�m��E� L#3�P箿�`u�b���젔�H5��O�2���<�]�,x����F5'����6u>|, JL����2��x�O�b���OކXѰݠ�͵H�>��*U�D�?�� ���z�n���qR�&�F�rf��rp����m�5�g�_j}i%&=8yO��Vl �j�VX��wa��O����e$�����Z�b�ܥ�-��τ=~�{�xg<4Z��?��%D��� ��V���+�G�m2���Ɋǹ}�0���;���_ �I��#?��ŅA�\b< ��� ��'�(4��z� 0���Q[� ��4 ����8[������~P��]��w��=u�Y� E���e�= ��Mƃ�l��@Eу"d"L2⫕��o���� W"n��Ě�@^i�$&�?�Y>�,��M0�G�:��� ���O�[]AQ��mbE�����@(��'*)�\ssvڮ�@X��|u�������T( �RR1�1�9�kG(��5�E0(�L�ұ���SQ9[�hg����}�>���~V�u��1>���������]��2��ο�j�ų_^����������6��[����`��A����P���v'K��Vޑ�I�nH��<OS� /osW�8�\�?Wc�l�_]* �6��=���� n}���c����A6Y�l%�2�� ��1 ��0�C����@=�2�G%��TO&y$�������'����� ���,�Qt��Dq�t�ۃ������r�\c���a{�(�s#1��i[��ӭ��V�-��K�>�56�ƭ��c�N)ʼԅ�;�� �X�`jF]���{>�Ú�IM�Ȝ�����Y�#7h>�fҖ{�`d����&-��Qʃw�#WC�������ᜮ�j_�N�b^U��@f�Ip���+���_���4�#��lO�⫣��#ߓ]��{�:���-G!�h�e��3l}�S�9^�$(D��� ���� �=�a���8���\�=;�#�Lտzv:�0¼�mG}^�h��*u�F��1Q0��X��=:�� \uo��;��@>u��!��8��%��h�h����+��I��&C�xm��T8��g+�b��qv����`F���6� �r�t��e>���1��3;�v��t:�_1�@�,R lM��eE:@)\N�ZS1��I�'�� �}t�Y\��)��f6�K�-�����-���� +|�������p��}���K�&/-O�c�̲�.�P��}��=�i�%9,��!~3��������0�y����̞/q�p������nn> 6�DS��H��5>c۰���nZ.U�5�4�@� w���z7g�u�����e*q��i`fÌʺ�� #n��@�w�T+%z�+�=4[��Ρ�)��븑�AIhT���tu�N����0�ŷ��<d6��]MX��X�]�V��|S/�_��Ann9�(7V�ҟ3�m`��dT2�Ҏ��iD*��FJؽ��J�P��P��,bHk��]��ũ0V_�r�BW��\Ī6@iK�sh�cC�h�U%-@���w�o���4�gl�����WX�b��)��bxg����g��j���=��\U�K��&����X��������ִ�B1���+��.,lk�?MW���.��{[c���pO�,<���GH����O��#�iq� J��~z����U��]A\<&1a�p6<�~��bB5��#��J.�#���m.y�����H�QT�C L(?�g0���Di!��.`�|��M���@�f�מ�:�VS���6���v$6?e�@(��b��D5����c�Z�L�'I�0���>O�r(��t���t��1�;\%�o����Wt��4�M�#�!��8��v�u����f�Z��{g'�՝�����#j�Fd̬i�d��0�W����������g>�DV*O)�S�Pq5��v; P��P���q����H������RI"8�i�G>#�2�y�=�;ɥ�{����U�D)�5����:A7�W��h�}���vG��e��-j �|���zc���@�� ��Z�u&D��-���+�2��lk�,9��xct��=X0ݣ7��l�Y_�Y{1w ��6�@W+�2p�處ݿ�X���U�mF���(�d��ÿ\ԕ���Z��6r2k���b���c��n�����lB��,���Ѱ���Xt|B�����j����*CJ�o@�"�.eu��[x�a��L��$Y|/�c/@���Yt����ߪ+�R��{=8��O�M�p�� ��,6"�� /ͭ���7/�Ϥ��g���̧r����i�Н��l�����?,�-J���*N *[��� �i��R�i"z^x�lK��tܑ��P�[��f_g��+��*�l� 2(X����]X��*�%��_����������X���, }��i�6*fw+-`���zYt!�U���t�֨,�����Η�,(����wz$̸#,z%��-,�ǥ�� ˩�/�*�u�n}��nT\�O��<��W���V��e� 4xs�@7��|���/�'5�V���v��q���D��\z��e��'Et��4U��;Ѭ$��S��Pݔ$"7ޒ<3OM��J,�Ӓ�j��,���Sf�u1��OP�s ����{v�L۞�7���#��/� �0��}*�/�00�"ϵ
Static task
static1
Behavioral task
behavioral1
Sample
wpyxxgq/AweNauts+5Tr-LNG.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
wpyxxgq/AweNauts+5Tr-LNG.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
wpyxxgq/下载银行-提供免费绿色软件下载.url
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
wpyxxgq/下载银行-提供免费绿色软件下载.url
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
wpyxxgq/快乐天空 __ 独乐乐不如众乐乐.url
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
wpyxxgq/快乐天空 __ 独乐乐不如众乐乐.url
Resource
win10v2004-20240508-en
General
-
Target
a5dfbfaf58887f68f0377025d4301699_JaffaCakes118
-
Size
2.1MB
-
MD5
a5dfbfaf58887f68f0377025d4301699
-
SHA1
8d05cf2128270785422b07783248cb8aadf70c8d
-
SHA256
6d04f7bd621de1735292b2abd13dc5fa36690b9aa9abfbac432a3d6b4dd20779
-
SHA512
7b4c11af10e27f3702db1313ecd2cb050dacd8ab5e2b0c29c2a624fedb24b54e05cd60c4d2d024be50c6611bcd19e0748c69962587a47f7da3edf431856be633
-
SSDEEP
49152:TdJAs2PNXiBzLUXswMIfWvndqME6OFedl39kBDm2PxdOBYYVNE:T47NyBzLUcTIfWvndqLPSnkBDmkq7E
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/wpyxxgq/AweNauts+5Tr-LNG.exe
Files
-
a5dfbfaf58887f68f0377025d4301699_JaffaCakes118.rar
-
wpyxxgq/AweNauts+5Tr-LNG.exe.exe windows:4 windows x86 arch:x86
768ba989ec7341de5019c696dea0f5b1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaStrToAnsi
kernel32
CreateThread
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutWrite
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
wpyxxgq/下载银行-提供免费绿色软件下载.url.url
-
wpyxxgq/下载银行.txt
-
wpyxxgq/快乐天空 __ 独乐乐不如众乐乐.url.url