���kS/�e�i�65*: &o���+-��$�OQ��Oz��(�c�*~�$̉�����f���m$A��_{Ol�{[F�2Gn�=s� ��-��7Y�}2��LԦ����� h[�]0H Vom�m��~��9�a����a��\�E��f�M���Z����z6�*�Ǎ��t�8��>��$�🆁�j�Fn�0��HF�)������)Q8i�m>��%ú�X4B�Mn�?�����.V���}n��ṣ��,^!Sp�.3_��J��&3��kv\�Y#�°�.d���Ќ�\�A-���8N���·�� ���M�����[p���,X�-�6Z���%ߵ��ػĽ �~�i�Fv��j�<0B�k���s&L'����r��A����B��z�}M\�����֧�Qr-��`ή%;�%�v���┉����@G{ߌR����k?�x.�A�hz���p�0�Qt����d6X>T/v�M���b9�|��A�9 /C�Ib��>������p(�ce�����ϖ�S4ډs�}}O��F�n���� �"�&o��ͥ�,Uڌ/��C�#��}e�5�E�p��'#�N�� &n�J4ڶ��k]E��8A~�������]ꐍ�.��:�*��_�f�@���.�T-��&s[-�Z��+� (�9������*��/��|s�s%Ca�=R:� ��s`ɮ���� W�1�{����q�(�#�Ö�� ��_�UQ/�Ϸ1�w�y�"�j8ԡP��ȟ�e-������g��)�/�k�����;}��T� #O ��E��!�V�o��m�Hъ�PvMx�P���wZ�$��Ma�u����GU��K^B=�Gon�*��=�F'�D\_�ғ���-S�Bs�a�UßJ,6��րbFxp-�;���lCz�߫2Hv���w���б���=;����F@4s�,���#o��)<���ʟ��yu(�kC0?����?~z����C�A5Vج�9��+�[���t�x���p���3��P�*.B�M{���]t9�'��e?st����J�S+$]~W��1jBgN���1��'��"0�i�$H�x����c�.������A�?s�1"K�`o$�b�_��uͬj&X��v���?H/w�#�LU�Q!`3�D�Vl�1�U������YW|�L���#f��+��"Y&���U�c$?���A�����Ǿ��]�s��~���Ћ<|FU�0aJ��@�S�uH�%4�������@WX��K�Q��j㕾�� ZPJ��Z�L���U�+�/\�,d�+���3m�4'~��GR~��./˸�փ�a���%Uf�)c������:��$�<��aZo�����U�c'��FJ탻�gOE��NdơOC`ףt2�b61��hoD�rv=���ד욾V �I����F_�_"<���(���I3�ia�w2/���Of�����w%�J֏���� کГ^$�Z�*�#a�� �&_�8A����P"���7@]���(%L��WU�b��q��mwp~`;���2h0�Q�h�E���Q�Н��Y�f�A�=�OÇ�!/ww���C��i��ET��F5^,�l!�}S�j��7_�#n�R4ė��1��%}*:9�V��y���k?�<M<���\��uQM�a�\� :�jt�]W5�Ƶ�5~�^=c"^�k�yԭ�c s������h����m�������7�oA��^���֚��:����Q�W9�4$�[uup,��:).��\��|t`r��u�������@��Tم֑�$p,�O�/cA���uq�Y�S?M��_���"�Q���;��5�bw�E <+��Pk7ύ�|��$˗���4(�o�c�������<5aq�!kO�Y��X8�՜�◑ou|fc[d���կ}�i�J�!`�ؕ�m��jk>����Y�MF�t"���_À��⡢n+[���Բ%-�(t�^i.�}̃���%�|� �uaa�����o�(�KMz�""�ȍ�A�Ry�bL+F�����1�^�^���!'��}�L��q�7���<}L�,1���rA�t�j�Dg�n��'Q���=�۪��|VwS��n��]�*��B6�U�rz_���/lh#l]�A=(H��wH��2�P�ɀ0{RbC~W�V��]��t�1+�\5��>��{.����Ѽ���������@��{}$�NOܹ--�}���1�����[Ɍt�J�6X?>W��+��l�8sa: }!���j<����I ���C�+&,��hܫ�w/����Ǩ$f���l�g,m&�����2�A��ו���=��y���-��A�7����{�I�-��*�^칇��NJ��}z�KAQ�Q��b�{gW�s��?û��gT$��n�3�j�oç��B�6���$Nɹz(1�t"𪨨�&�{$�G�ê�"!G^OT��*Ω!������\n z ���O��o���,��B��ׁ�:�x�n~���L5�i?���{>5G�D��nPc�g�l�&��A �I�;�/������ϭ��H���3��W髎�v��$�*�nM��: ��3�\���p���cX��Z�z��$8�� \/�x[u߯L�eO;C���p>,d�_?e��c�AZR�j�(f���,�=��Y���д������qI�M&i-՞[��� @U)��7�?S#� ���̧���8���]ް��6�d h$6<�p:TB^f��5�����Z��n�l@ŜYX�Wx��s�JS�LW�E%F�P9�d������݄�9}#C9OA��-�7�����_�/w�m�b�Tu��f� wl��&+�h�Y�( 5�lt���o����� v�/ �b���`qe�m]#I��Ur����[��)�6-����R�P��I��VqE����̠���;�1!f�8Wij�I�[Ɉ��j��3�Y>��X@^���d�k�� �1\�x5�F=5�����ƮrP,��P7�S��(�n�$6��&m���;1��G����{�́�̛ͦgS�j��z~�'W���e�+�3��e��ɧ��Cq"ʝ5�ȵ�
Static task
static1
Behavioral task
behavioral1
Sample
tvm-eow/TRiViUM/EoW_KG.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
tvm-eow/TRiViUM/EoW_KG.exe
Resource
win10v2004-20240709-en
General
-
Target
3ab3ed2667782fa84777a0a352829966_JaffaCakes118
-
Size
179KB
-
MD5
3ab3ed2667782fa84777a0a352829966
-
SHA1
cc351db9c4964ab768b5364262c77547276284c7
-
SHA256
429bc673a582ab0ecdea6e4643e6960e419d17dd36df0b268721d587c19bea27
-
SHA512
8ed3a49ca88888c91df9d8049ec4ff59619dbde6aae19cb87a731b116065d78bf538c739b8e1cc9ec4df5f0048c57f8052b7fd61d1fbb4f2f1a03bc611c1ee64
-
SSDEEP
3072:HdphfRKx6m2ifmiFwBYJjqOa4mqgq1isRj/Oo/kGFxDqW1lQlEpLTY3rYDePs5qX:HrhJKg5hmBOOa4jfis9GCkw1lQlEJY3Z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/tvm-eow/TRiViUM/EoW_KG.exe
Files
-
3ab3ed2667782fa84777a0a352829966_JaffaCakes118.rar
-
tvm-eow/TRiViUM/EoW_KG.exe.exe windows:4 windows x86 arch:x86
770bc29816de505656f7d3967789642f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
LoadIconA
kernel32
HeapReAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tvm0 Size: - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tvm1 Size: 184KB - Virtual size: 182KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
tvm-eow/Прочти..txt