��H�j���u �W��Nx�4KXI����_X����� K���_!�Tt5= �q���� �sπ#����t(_�$[*��&P�/!�ڝ�R�!�=��Z��!�����/k��7�����j}Q�(d�$��0����Sz��v�9��#�D0�m�t��&�� w�k)�� ����`�Z)�j^%���!�\4mu�?�H:��R��O's�k���Sa�na����� ��#SG��8��Ȯd�xx�� C׀�荀N�[G���GӃ��YLY:���*vi���?����f��J?XV�!C�Y�&b^�`J�U��ETcE]�A2WoCb��,�f+�Q��a{G�� cۧ��+j�2�����KoHm3�-0/2ܞ蝆ck�p�K9=V�G�e�������/��' w��g�;�=E�ћ+���\7�lvN#�S���L�=���J�*E��iN�������B�1�G�$��@C���9�`�2�I�=��ε�[��g|�"!Qz7Re[ݨ�$���h;>��s���x���X��o[�C�"K�1�u��f����p���o���[��=qR"�&m�v{�Z��D�|�v����5�\y$��q�P��=����瑮d?�EPye�U�k���>�hS|PH[�7���ܙ5���T�����Z�k�$\>���i��aZF��"E���^~�{�q�4���LM���]��Bjv��P�S�jw�y��߮����ouP�<���L����rsj��[m:�ن�6�ށ<�����1 DD���i��N:�A�D3�}��4 �P��~,z�����S��_��|�vGm�L3��w�݀�0��e_)�B��=���4��'WC�;��n�[�P1t��F �"��*HPO,�.ut��.�ʨ)�X@����%H��K����:t���+���ԑ�`��� %��]��\�o��r��*6�?�jJx�*�T2Z��m�����!�������ځ�F���h�ZϮbp����hj��n�����Ȝ t���`ݛ�d�(�T�3����`�����˃��*&�a�����_�� ���*ͨO��*)�&M���h��[r9W��X,�f�&ޚ�O%\��ɹ�R������n! z�pD�>ǔ����Y���ޗ�����n���8������Ps[�|B�����&fj�ںP�k#�祊©�n�vO�"��9��k�c��51~���ۊ}�8���m(�)G��R%���ٷfe��jjz�cڭ�$3vd�����@f�h<;��5;��e��C�����1E,S���{�6k�Dʳ/�b��|�\���8��j�>��{6�1a�L���W �sH�M�����`��[m �����1˲���-���0o �^21��w��Y�`A�L�8^����c2����E-�hF�H�i��I1�]����$�1�@��L��A����~Y� �Q7_@����Z4�`$��(qB;�pK�".0H@�?C��C��l��qT�V��-���� D�e�V�St<��4�=5�-I;�r 1"��>��R:��N"R�%�'m�>& �<��� ��̳Jbfl�cə�%j,��ee��W[��L�[d;u���+$�����G�L��}��}|v��m��Wk(�( C7��!���Z��(�-���ɂ8[3��Q�D�<ҟ�&�O]��7M��'���zD�\ ��Vri�F�pP╞?�f�Jhh���d���4���<"^"�N�[X��xm���[7 ����`v�}t����,e�Ve�,���%�4��3��o��wX�v{��Z����������� V�k;�W�Yd���,۰n���3 l�qO=B�eT�,L<Ob%ȗ4�>�Ωّ��a��o����_6?��a��j��!ۋN��KK�:�4#��x�wm`��Z=���o�sJy��K������κ��O��56,�ɀ_��-���J�u��Z& �\�[�@��S5�d.�\������W90��xwѩd+����=ؖ�^��*��E� �V��ɡ��$�[�k�Z1���6��Ao��ë�TR�qrq�#���:�OА�v�5C�i���5�7"x�S��,�1�;זv ���MH|�*��N�����Q7�a@�tན@�*S����0�'PΑ�$N��\��l&˛p��[��}��E�o�Y�E���l8c�-WzQ�A��X��Ѹ�ݖ�]�;<`g�Fq��>]d�T(��X.�?y�Bm���}cE��^G ˅�PV��B��:�� Z�+����a�9!/vg����#���/�U���^�D1 ���g�*Z��:�g2��l�N4�p���_h!g&=\�;=(<���ϡu��_�p"�M*��:M]�w� ����H�xt�+Sp�*ߴ�p��z���9w��+��ݕg!:[Ԡ��Z����:�v'l����+p�UMI��>��S�N$Um\IUl{tr�lx��l�Q�j� 8)�ت~�2�m��֨�NᲧ��D�n�W-���*��N&���!��n��_n���ۊ���/k������0{�m�'z��4B5�l�Y��A?kw�E����o�������1t1�4�6�k2�߰�����2�X�|�M���^[�T]�D��� v�Ybo���nt4��sn�E���B��O��~��8Y���������ߵ��I�4rf��ܦ�qn���Nv�=�>��"0�x�EǾ�zR��ڞ����c�Np��}u��CVE�I�PM�/��Af$�c�53���ʀo�)r�m�#���D�IjH9ws�k8����O��P�H��<���I���e{��Ͱi*���� �v���[�G�}�g�[����J������F%��nk��_`_v�F����%/�&zny�ۃ�<��3d �� �����'�Uy?Ꝿ� � ����.ڄ�d�G�C1M��A�6l�������$���*�45��Q���)x=-��3s<�Afu`Ƥh0 �YV�.]����H ��]�)&r�/�=�-���
Static task
static1
Behavioral task
behavioral1
Sample
MPayne3+5Tr-LNG_Proper/MPayne3+5Tr-LNG.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
MPayne3+5Tr-LNG_Proper/MPayne3+5Tr-LNG.exe
Resource
win10v2004-20240704-en
General
-
Target
285bbb8403da01427fe7c9d136b1201d_JaffaCakes118
-
Size
2.2MB
-
MD5
285bbb8403da01427fe7c9d136b1201d
-
SHA1
8b12f10571ff6f898e022f6ba2ffc68af25345bb
-
SHA256
f4e64e6b1dbfa8b25d6de845b190443cd21824d4e57af7e3039e6e0a49a2cb05
-
SHA512
02e3939fc666068654c809e456af6860d53d2dba1079d245dd3e9f0ae727c20afb35f346116d8f0af089af35de470e90b1a2b02d95fed6cb229cbe497ac5c359
-
SSDEEP
49152:L80riONPbeQDBslueICrDY7cYLzq4RYEz2jKdhHb8I3tsVPFrjOl/NcW:niONPbemBsDfrDY7ZrYrjKnHb8I3tMPk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/MPayne3+5Tr-LNG_Proper/MPayne3+5Tr-LNG.exe
Files
-
285bbb8403da01427fe7c9d136b1201d_JaffaCakes118.rar
-
MPayne3+5Tr-LNG_Proper/MPayne3+5Tr-LNG - I.N.F.O.txt
-
MPayne3+5Tr-LNG_Proper/MPayne3+5Tr-LNG.exe.exe windows:4 windows x86 arch:x86
3669e83cd03a7674001a1d3814f94765
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarTstGt
kernel32
SetThreadPriority
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutReset
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
MPayne3+5Tr-LNG_Proper/VERY IMPORTANT!.txt