u3ۨ�%����c���Pa�`e����Ž����)��9�tha���rk~�[�<��LBĺ�E{�8+d�[TEW�+�u�ڊ��IZ �<�F��X휥��m����"<�} �e##v9S#��%�KӸF�i��j`� 3*{p��Dm����F��Z�3-��CJR��aŗ�ʴ����,�l�� =�3�.�i;�V�,|����mV1�q���n%4��1i��"�hE���Jw?����.�WB&�3��0����?;�1�hoU^}P�=�&U6�� ���y�l�������Wyv���d��Qhޫ`]<�8?�W� ������Lv(�D��'K��>�>���+�}���� b"�� ��r[�+v�+��x%���%:�����l�%�l}@��wG*ƫ����� �g�ӏ��,���48o�6��yk�H.�g��~�˸����[�Q/���ҿ���^K��;��B+1./��"�� � n� ��a�Gf��$F��ջ���D6/�?��D������%�[�>�2$�x~�Y�\�-�W�Zf���{�g�]����n�-��� /m���ɽpop:�L�-%����=V��rGI�����,����7��+���o3$����eٱ�k�[��ٜz�7�6��<��]�Y9���W(��.�?�Qz:�����n-������tB8tzL�ݎ�[x����^��@��� ���*�X�.�>���#����N��(�=��kK�di�;��sD�߹Dsz:� � ��x��U��'V�_~Xa��6��n&�P'P�#�X��:�DV�X��\�6�a� -� L rMZ��m��6{�)���?��U��u��r��� �?�#�v�;J�_�r��VXN�$y��������y�����2��� ���7��IӀJq\���Җ;'���M�� �jp�ۑ2i��߷" �ZiiW,����]������^�)�`N��I����N+d/�J�����h���1����k���V�K}l�|����KY���=��GS���tDT!���� �cP��g����.y�i�׀s��F��~�����KW�6 a�so}gX��ĔXt��e�� ��CN��G�"�����,��o���(w�÷43�|���f�q��3�E�����/U]��XE�]�H�|%P��k�}��?���\2����s�w4p����vEz7�!�t7 �~�w\�3��"�͂��$��Ě��:[1�5�Z;� ��kI8������Ι,;�Eª�5���8�}8*�^j�o���4��*A-�Mu�y��O����d�B=nB�L��� �[�V��{?L �f�A��j���p�ʉOkG��x���,�;�����:A4�yZX�$ ��k&,���5��Aq�yiP�u�#;cC`[o`#8��d��a�L�X������$u�JD�J�js�:�J���|��G���d�|@K����ϕ�1IDw�e��2)��O�,p��ҡLU-����������25��!��QZ��ف��Wi�F6���9tXwrԘ���5���.�F��)0���^{ &K����,��� � `�_��hw��9����1l�_"����ѹEơ8*�����!\�0+BWB Y_�ysT|��1�au��j� }eW^�\�[�H��we n�MQ�3oF�;y�$pM�a���( {>"C��,E����8�7},��p ���,3e#_�l���6ȫ��iEO���9 �6&&i��ӌ9h� ����X���R'@ST6��f���0�z(����8kq��u&�QT����hfk,yN)��Bm�|N|&{L��pQ?�U��v��+�o���Ɓ��6���Q�������ħ�B<5�B��X��<�Tڋi�d�H�pL(&�>H%�!Gx�� qnrS< �� ���-H�^̚�����|J/��`x��c#Z�7#MBu)��e��X2�$ܔot��z1e\����+��@xFV�9��`��s�C8�<��6�g��?�9��u|�8@��K>i���&ڋI}"���_�ZN�]�;ղ���$%��u��շ�'��XN�mK&ҡ#�hm)lon6�8i���D,LR��UV���hw����{���)����)�9�J8���װ�7no�k������=e�.���g+1g �0�d�[֔�ZX&><���q!�ٽ��؋#�a��,�KQL�܋?`�~�q��!�@�z�/��_�p4���*��i*�6��3'��R����CA���;�m������å��"��>!m.Pm�^�*z����.�h�֢w��ԎB@Y���Dj�.�u$щ��~�o N����dܺ�o�*���L�����xh�c�K�����%�F�F?�ȍ`e)ܤi��� ��D�6���45���'w�MIA�5Y��yr9I(�H1�oN��\e��L?�44�z��ES�s��uk�&r���{>=fYX�h�ֿ�ԣןW:w�']�W���HK�y�m�0D�,LX<,��"���y��`��>�=<^L���E� �ּ��!����z&}g�G:W$;^�?ωHs�U?Bp���"���b{u!� �~}�GK��|��P�r��Y*,ɚ�"������\�'��%����Ek���jV:��Q��~|nk"��m�D��E�01�U)�d^mw�������D�e ���$C�o@���*�)�^�g�� Lo#�h��w�Y��t����\���]X8`'��V��Y�V�z�=�����r�Nf�=��W5ؾ�u$e��a ����S�����w��;�ck%0#�T�{��<+��/q]_ M���x�{h͎~�8v��b�k>��K�f��C�6���&�`#p\��9vAn��<E���Km{��P5�:�ΰ# �X 4�� �(΄�M��fՅ�f%B�{"Ck�o��U�m\l�@�ʄ�ۑ��.O���-�V��.�F\���E�j�6E�8�g:�X1�Ҹ.ۛޛ�����ć�q����d��UE^��a2G�;���8+hy���V����N%+��oIEF�������f��a��1�&��!+f�V$V����
Static task
static1
Behavioral task
behavioral1
Sample
assassins_creed_brotherhood_v1-0_trn-15/ACB+15Tr-LinGon.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
assassins_creed_brotherhood_v1-0_trn-15/ACB+15Tr-LinGon.exe
Resource
win10v2004-20240709-en
General
-
Target
7290bc4f71956924429292739580b6da_JaffaCakes118
-
Size
2.1MB
-
MD5
7290bc4f71956924429292739580b6da
-
SHA1
6de401ca1e2779d1e29057d0c298a28c46fd41a0
-
SHA256
83df4615f11ed0f989a3ef0bd3d1f7e151c83ee9b488a4a756ac063a35c29ac0
-
SHA512
1d9f9133cac63c2aa27bc26a74da7ddad2df6494d5d2468a40535e9934e94b0f456269546dd91832f0c1460a09f9d48a36de0bd01e123487fa36767c022515da
-
SSDEEP
49152:n5Nq1EI6VHsK0NBvGPT7N5OcVzCfPxroRHHM+d:nq1E3Bs7NAPT7NlVzkeHd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/assassins_creed_brotherhood_v1-0_trn-15/ACB+15Tr-LinGon.exe
Files
-
7290bc4f71956924429292739580b6da_JaffaCakes118.zip
-
assassins_creed_brotherhood_v1-0_trn-15/ACB+15Tr-LinGon - INFO.txt
-
assassins_creed_brotherhood_v1-0_trn-15/ACB+15Tr-LinGon.exe.exe windows:4 windows x86 arch:x86
31497f228e20571cc8c49d3451446605
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaStrToAnsi
kernel32
CreateFileA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutWrite
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ECrypt0 Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ECrypt1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
assassins_creed_brotherhood_v1-0_trn-15/Cheats4Games.ru.txt
-
assassins_creed_brotherhood_v1-0_trn-15/VERY IMPORTANT!.txt