�7�g<Y,�DL~���~�F9D�X*��՜v�,Guɸ�S]��]�?�I\"GJ����h ޯ�978B?'�������L��&+�; ���a"��0�`\�&c�}6N!�G�h��@�hf�l��p��V�y�'A�2:�Ň��WESθ��ό�ک@�����I���K���)f���+j��rۋ�q�Υ�|N�Y��'���?\�t���)��ig�9KQJ���m��������M�����B+EZ�����?�n#�m��A@m��С�>c�K�PUg'���F|uPFCC ��*��,-�t��WЯO�Ȁ�:����)y5�6:�~�%�״{B���9�w�r��W�cr�[�p��~]��ɦ�Y��>��B�{?_S�0���YL�#4+�n.s'v�U���k8��dH������:7.Z�e��Ҳg��>�W�'v:K��%��X ���v?hˍn�o�5<���6�: %�������bg��ዒ-&9�E���14hC&4�oyE=%����� S��1�)���r3�ȷ�E��u������87jm`��� �����|���C��ߍ=��ΜC����n�ʨ��TK�!�3E�FK�����R0>.��j�cMc�jm��V6Y9g ���sξ��� �>~�O�$I��L�#�����WI�y�o�>���5��n�h8X@P�Y�~�s��V��e��+�}��3���'�m���]}�p�.��.�Fצ���_� ���pv���X��6џ>�UDx��Z�IS8�6�Sہ�O&��E#��Ӳ4dc$p:��X��?�ܑqb�e�|n�3X���Eߗ����zK��W�lU�P˄�p�ܢ9�� ��@���58���֛��q����%�c a�9P�5�-���"O�5c ��Y�]�I�Z̔�L�� v��L3d��e����J/�������@|ny١�EW;VB��)���L��%���%0� 22q-����09"��[��dx��aBP�a=� ��K@�6�6��G�b���� �R�@�����2�q�|+���U��K�P��P�6��*\<0�@�� ��X%e�z�B��J+Q}��s��4����?�3�Euh��~^"��n/�gC��,Z�Z*�z�vdl�4?���Sסn"��k]�����Ϫqq�8���}���6���Ewl� X���i�}r���'+֠��5��Ƌ�D�n��M<d��u��������>K�-���.0N�V� ��щrJ�k�tåع/Ai�F q�s�8�S���k�툣�/\�褛��z��ᖔ�xd|F�N{��1��鿓�X$�.4d���3����?�9�N�fAA����j�͛'ԃ�j�2�����7j<hҷ�!��KOI�#�.��=��7FT����cr����]*� �����[3���N!Q ���@��u���Meo�ɪ��,`;��HA�qV��H@�#ȓݏ����1����Hd;��]�&6����J���m�]����%��!c��X@�%Z�ݜJ7�N��͡#���pc�I1��B��;{�����Te�_N�p����އr�E'��_�Fy�����O.�z)vט ����F��i2nق�ͥ'���ȟZ:�fR�!�_��/��u��W�$u�;���ơgʌK���pthwf�ʥ��>�f��Yn��6џub����ze���Ä���\3��k/�mv?s̋�h��\���G�o"�ɝ�=hοz0�=�}8�����%��/=�=�H�Ѷ��M�^�ylE�R�Sh[�N��� f�C7����)�� �\���Cu���eېH�b��J�{�)�����]�D�((� �C�z��Ɠpe\��!�(����qsLJZ�]��;���a�����Q���=P�>|��04l�������۶�H`-.�S�/���b`۳ ��T�.$I�����V\K�fnW�@�a�Q��r/��*H�GN*D��ǜ������ӓ�����4��]0�4���n��5���戝�8s&p+m.����{|+>�b�c�����,��e�u��ꨣ�I?q���?EԵݖ�۹�Zjc&֍���L2�� r�=/�C$Fq�=�,V��d�4�I~:UoPNBN�{8�}\����J�+�s �9ʊv�-Z�*�SŎ�<� ��>c�sw�U�JH�� /r�F����.8Z�B�|c陛 �O��^�����oc8x��쫄�����Y0�11�u`�G��~(����z�)�}j3��M�D���ϡ�"�H���6��$�S��D"��>P]�hR�U���;�@o5�)B��FMɰ��W�]���|�o�%�DH!I�H�O��x�Ǣ,�e:�s������c`pr��G�=�J�� szC��.7!o}R�Qlk#~���*�:{�X�XK_����j/�猱/ |�H����N`2#Ww���?Ne�`�����L�U�"ـ��֒5�S�"�f�OQ vVZ+�ʩרV&j���r��� bx�0_�r&���Z���L@�X����pd�#m�E����@ý��� ˴�����|I/��+Y/s�%�|+�Q���\��T��|��oE���}I��^�e������_&jت�[�"�67ŷ���ȩ��<�29�� 6ٟ���q�eYϣv���8�C�)�1=����p��h}#�L��V���HJ�ܞ�5m1QXx����3�6��ǒ�Z���:�-י�8;d�鍋�̛o�"�J"�q�#裁������BZ 4�=�̋���~��Ÿ�y ��B+F�L��7ul��۴c��듉�f�����Ā�h��Qy�� �:����4Jt) ���q; ̛���{L�^t��¥Tr�1UR�9@�FxQ�n�t���h̙S� ��@����%�����lj���}^����☠$/��@�U���%���� `w����g*���oY�������ᾔ�#m��#���9�)5�I�g�d5�6�iz}�ȣ�?�g�2Z[��d�� T����
Static task
static1
Behavioral task
behavioral1
Sample
MPayne3+7Tr-LNG_Updated/MPayne3+7Tr-LNG.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
MPayne3+7Tr-LNG_Updated/MPayne3+7Tr-LNG.exe
Resource
win10v2004-20240709-en
General
-
Target
322a3708df37b52a221af8a7457b7b44_JaffaCakes118
-
Size
2.2MB
-
MD5
322a3708df37b52a221af8a7457b7b44
-
SHA1
1cf1f7b891075946e4502f0fac4ded456ba5ebde
-
SHA256
bbaf7a90eac8a314554a4d3533eebe464fe9fdbfe86497d81755e7d96a6d011a
-
SHA512
3bc1947e3156ec6b70a3f7df47ae5d44008eadbfaad8cbfc2e0139d2dc26c3239305b64924320a7a178dee000c8bb06fecda0ae24314f89be86ccbbbd264a121
-
SSDEEP
49152:J7/tgbqWQRAoMGzKXIwknJJP0Prmm6At4ZNkzOEYsr+Iw6r8skT53B:Z/8FhpXIwkJh0jmmXg3EA96PkTNB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/MPayne3+7Tr-LNG_Updated/MPayne3+7Tr-LNG.exe
Files
-
322a3708df37b52a221af8a7457b7b44_JaffaCakes118.rar
-
MPayne3+7Tr-LNG_Updated/MPayne3+7Tr-LNG - I.N.F.O.txt
-
MPayne3+7Tr-LNG_Updated/MPayne3+7Tr-LNG.exe.exe windows:4 windows x86 arch:x86
51e1d0358cefa7a2d4b72727323433f3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaFileOpen
kernel32
HeapAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutPrepareHeader
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
MPayne3+7Tr-LNG_Updated/VERY IMPORTANT!.txt