���E �J ;��<>���&VR�6���^0'}�՟� ���U��? �F2��HeT�.�z�7�U�� ȕ��l� [ո}����8{q�p�kDe�f,j5B�qLl�\��IۄN�i8$������\��ʏ%~�-����@9��,��/��P�m��Λ��]��M�e?�~�I�6 >N�<�{; o����ɧ�/������r*�c+��<ɍ��d�����۶Fa�wt��@�h-�-.�巓 k�6�l�H������S��KS�I!�0��w���/T ��u�3���������\w�Y�+�qn2O8iv�@T9W2�i��>U;�,�1�4u�;���eoeOo��[��6U]N����� A&������!��LVS�a���T)������c^����`l������V����8>�>�*�ů��.�Vb�����X�N�NM,�W�xƬ6k�a�� i�V�]k��^��)y|���Q����-`�4q|�|r��DC�Q���аh�mB��=R2�Y��Mԧ�BB��p�5!gd�.k6������3�/��'͎��Y�w���B�0bm�� U��6��Q?�T��a*����w5D�+�����uf��8�Y<��6�x�]����2�8�~Y@���v��M"�7�2��P,v:RU�½Ή�dk�Q����>\��� 5�m�9WZ��N����vVK�Ya��m)���9�PWr_��`9W �פDU���rԾ��f݃;J�^uJOdV;P���^��K����}�.gӸ�sd7�p �W� �|��4'�)NO������L<fP�����$F1}��>�Cĺ��r��-N��?CM�z]pv֞BB� u�ș�L���-�A�g���f�5�����09��Gl�?U�(�u�(��dڋ@�\�D��پ�x'Ce�1C�� A����'~��K���:E+� r<����F��X(�+Ő1�]N�>ጩ���fx�1�"[�Y&�SRUUw΅4�����A�L* F��2�B벩�����(�}���6����m w����;��!�C��z�zh��+4�}\��2AGɚA����Y�B+��hU��m~X+�(N�lh��e�{3Bٺ}����j�|����<ƹy�w�.��Q�_[ݛ�:�$�HL�B��z��k#ڤKD�� N�k�Z������ �%�/ U5!��F�F��n���ԝ'p�鎴�Ay[ok�%�5�F}��#�Jϯ!��TY1e��h���H�p�z+=�;*y�� �R6̥��sL�H��C(ہ�O�0� ���G��4Y�&:��l��I��������z7�P��37�2�.4|������?�,�!�gx�۠�g/Y9-,�#����{��-!��F��r,�}�I����6 ����)k�be����L�L^����ǝ����t�g�� �9���]Io�~����u��+����\� ������S��5�Ӆ�&�$gU�8��.��DӠ'���?�0��h-��X��J�kR��ŕl|$^�H��1!w���|O�I2V�p���/�N��c,�)Q����O�%���0^Ls�v�vB��a�_�&�O���ȡ�X�^���O6SA��*�Һp�y���}$�V�.�� ��%Z!�~����{�Y`���wT�=��������*�l*���ܶn�� �b8gXkM��FY���������*J�y� �����#���y����!L�n�y� p[������'���VطE_O�'�X�W�+�)3o��93���B'Q�Y��3G��q�M��E�2�.0���=���p���E�d/�D��(���u$�L�̨n[z�'���OZ?���ea������R�r�[�?�8����Xt�>��8�ᆐ lrk��x����o<[��2�O���������G��NYT�~����o��@&\e�\NX�[X��b��%���dc��ڏ���Q��cv���%��N�&\q��N?.��n��}��_��q"��r�&�S���>0��t�Gjt؝_���%L�TIW�o(��%��Y9��O�i�����J�t��t�����٣�;���?��o2̮�鉙��v���8����!rT��q�;S�!��+���߃!)i"sdW9��[�V n!#C�7��� ���o��`|�!~���O�-�����������[8��u[�Qdj�l�m�$/�+��_�yĚי�T�T��y�i�Y�tk�h���H!.��1B�$k�L\�b�����¨�|�w���>�@o ��=qnd�n�ٔ:�C��a�azt ��͒� ���k(�l�X ���i���~Ņ�B�oˎL?�JV1�?�q�L{J�� �2I���/���=n(���dK���D-������,�����[���O:Z�� G,80N�Ө��Y.�������z�j�ϛz���ȴ��%8�{3K�h���d�L¼���R�w�����vT�o��H@��,+G����U.���y�1e���@R2� �ʐ��E(�l�#k 8R�ECj��؆�BP0�RO抓N~�SA�;�w�¾*`���ף'���S/�������壁!{[���xF>`�$��8�y�������� d+��^ �oH���rj�Xdz���^\�]��V�&��k�"�06P5sǥk��uK�c��;d�`~�֧O��÷�c���0T|��K�����yX�y[/iN=̔�#ؠ7gQz��Κ����Uj��>��2�Sɘ����á�5@�Ad�e���?��W����:����t*��9N5�k�� �Z|�k)ѾP��#ojO�mMu�$�v�͚.����ɸ�i�ZڕD�)�(\6��@�����YP����JG�|U~��w�^^ ~J[�*Yd��O�l4[ ��<���� =z#��m�&|G��4��%� S�&�����m2~�cw(�<�R�란_�z�~<�˕��f>�^��*N��v�f��a���O�:��"{���Jkb~�J�$*|5"k��� ��>���F���;�A�ƀ�]h���n��-�,�TN�1���������E�����|I���!���y��KOlsM��kvl�^9�V�a�
Static task
static1
Behavioral task
behavioral1
Sample
Syndicate_v1.0_12.Tr/Synd+12Tr.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Syndicate_v1.0_12.Tr/Synd+12Tr.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Syndicate_v1.0_12.Tr/游民星空 Gamersky.com.url
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
Syndicate_v1.0_12.Tr/游民星空 Gamersky.com.url
Resource
win10v2004-20240611-en
General
-
Target
21513698bc7a0bb7beba56369f27dc31_JaffaCakes118
-
Size
2.0MB
-
MD5
21513698bc7a0bb7beba56369f27dc31
-
SHA1
03c1ef270a538ff17ac6a4374dcd059c378630d6
-
SHA256
c2adfb0a1dd9625cda0a347fa54efc554c17362ab7b9ae44c0df1e6d9b13ceca
-
SHA512
a8c9460a5a5d7aad6a58d30fe5d40725663453acd2d078160ad685ef53dc03bb9779a538589e2cb6216e6ff317cc13b983fd47f80b696f0a7b65729f8988a8db
-
SSDEEP
49152:fk9aXC4grijNhQVbxTdgQHaufzCnzrv7jAZwbPJjnxazqFsm+kCbooI:89LhgNhYxqQZLCPPpbhxazysm+kCXI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Syndicate_v1.0_12.Tr/Synd+12Tr.exe
Files
-
21513698bc7a0bb7beba56369f27dc31_JaffaCakes118.rar
-
Syndicate_v1.0_12.Tr/Synd+12Tr.exe.exe windows:4 windows x86 arch:x86
d52ba2edbdfa2867aa377c3b882f5b82
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord716
kernel32
WaitForSingleObject
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutReset
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 954KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Syndicate_v1.0_12.Tr/下载说明.txt
-
Syndicate_v1.0_12.Tr/游民星空 Gamersky.com.url.url