Fc�:�].�mNuu:�o�Z9�7���~"� ��qVo���J=S�sݱ&�c������1��YKJ�1�;cs耫{�Q���{�I5�VHr*tVG#u��{�'t¨�$�9$bq:�]��NMA�Ƙ�`�Q���WC"/M%b*N��ʩ��i[���R�0(-��W2�Az���@IK@<�y�;�7xS�V�;�,xk>�h�P����������K��e�F~�qᢏCD.U���8�c�;7,���������˹'@���*J�`�j�m��O��Z���|�å��f��I,!{��,��r<��9��صhɤ��St�؇7��8��H����曱*k�^I��r�/�� faN��W��(�Ƌ�P�Б�k�&��!��/P⊠��pwI^�r���0������Fawxj�d�_Y�Vx����*�d�&`8\6��S�E����CV胗��!�;�r���z/��)l�M f�<��P$u$ab��d�:M��+�E��k����4昼5����v��{ �t�Vh�&��0l�y�TO��Bun�@ԛ�������g�%1|�s��]*�z�CLC�R,��i�Ukj�%pT��`�."�6����z���e�E���A���.���(��89t�IGv[؝�p}�_�[,�n���Wi_����u�b�Zq�!�m ���G��ҹtj�W7g]���Q��?n `��9̟d\��xP��:/?��3��;u���� Y$.����(*�+���Ħ��y���� Mc���DK�D"���jD� �<ڣD�r(bI����r�'��=���FFG����,�n����^� )� ���P'���9!��Xd6��ʏt��qrP��z�E�p�,qx� �8���,g8�f�&��L�k�*L:Ldb42p��չ�?��J�DqcZL4[�m���7HZ���6;d�?J1�]�z��8��ɷKw�����(/ZR�yV�������dP6��.6,���Ɍ5)S4��, H�I7j�~X�X�#�Wb���i�ն�'?��� ���R��-��l���JLQ�aq��¤�a]�}�����S��V,t���&���#Z�n'���;��Bk3|�P������=�}8p�\B$�JH0� ё|U;!0!p�BY���n�SsVˮ/�諩������M�Rz��ϭ��� �$�=V@�Z|I�6����� C���j�0�gt9{�I6-�I���S������ֶ����]X���䝢����r3Sl�[ �|���HNĜ}FkL �*�j5/���MKn�J{��Ѕ8�2q=��5#֯���Jr(�/ȷU"����e�i�}��d�_��u^��D���%&���q��u# Ax�k�r����*�&�" �I���Y���Q��ن���a�_!��B�L�&l�e3�Iy����u��� ��*��P4���?V��'FƈфO�ûN��t�A��2YX�%['��}��kS�^���C`��OrtN�9���s����T3G�bi ��G���ӡ3)3H�_������݅7~��8%X)_ M)��=�r1�y�'��-��c�Q'��˒Ϛ�8�����nk]u�d�/�4��Xv9ն͠Ho�j}v%1�4�PR�}���(�1Pmg�W���f�z�X�f�����D�TF!azQ�:�L��F�p��-��yA��o�D��Wf=]���D��S]�9y5a2Ѐ��6kl��.��i/���?Jnщ-�����TTXy�g���rp������e����.Ě�h���Ss�RL�F<:Uo�`!��wGC�2�Z+�sh>���ܷBMh�n�\�T��Ar���#�"j��+ #��{�iA�� ��jY:o8��O��Sl�]<E�i²�߶��4g�P��/E�fcW>^�ߪ����C��4�[�6�FB�Iw�$��I������3�מ����Ը#�L��7MCD��U��7�W��G[H4��@X<)�>��� )c�2P�6��9GNT�z��f���v�K���z�pĭje�w�X�?R�ϧ �{_�ʐ�ve��CBP`�>x9%-̛�H��tM(P�o���"�@��u��c&��^O��d�ɐ�n�� T�x� G����l���^?���6���<������C_��r��??� �웳U�����J��Ї��_mR&Z*1���'H�(Bt��"�t��*q�%⌮z��б� &l/V)A�AO������]�}ȁ:�/XTa���\u�ض�M��j,�$�SV���V1y>��"k�����jљ�sr��(}C�9�V{���e���C����+� � ?o�w�@U^[H[@�aq)1 ��K����K{����(q`�u��D��@�<~"�8r�9����cf�1�#�p��M]C���p>��� ��G��"�D%����6%7Q�'4�?���|�'ȹRGCik��a�_^�E�Q���j)�(Ȁ�u!18��o�? NS����RZ|D:�� �B&m){����P{��c�M�$�#�����L;@4������&���,�&-jj�5039gL2���\��v���'T�A����U>tԭ�~����9�O���W5��1�Ƅ�����b�V?�/�RQ��N�x�P�n���%i>�+��-)K�n#e%I�ih,g�A������?Ћs���ڨ���\tK����6�;�t�,����=^Z���yM٦M���Sr�O�{!�ɴ?3���P�e�d�/�(�X������g��M� �<����<���s�� �����? :.�J��8�F�GΛ�>�_q��}�_� s���MJ��Ʃ�lM닡͕b���bG�\ 9�2��oq��<������1$Q[1�G����Z�[Z~�,rqN,�aEẈi�5Bz"��En���֚�����+ f?^�0�60���X6}���tSJ8�!�����?��D��]��q����03 �@��չ^BcH��Z3 0��]\Tw��r����m�0g��W����E�--1�_�0[�nfh�C�G7�7Hg��)2� �L�e�����G�H��n�`��� z W<�l�u
Static task
static1
Behavioral task
behavioral1
Sample
1365926436_far-cry-3-blood-dragon-treyner-21-v1.0-dx911-lingon/Far Cry 3 Blood Dragon трейнер.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
1365926436_far-cry-3-blood-dragon-treyner-21-v1.0-dx911-lingon/Far Cry 3 Blood Dragon трейнер.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
1365926436_far-cry-3-blood-dragon-treyner-21-v1.0-dx911-lingon/Far Cry 3 Blood Dragon трейнер.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
1365926436_far-cry-3-blood-dragon-treyner-21-v1.0-dx911-lingon/Far Cry 3 Blood Dragon трейнер.exe
Resource
win10v2004-20240802-en
General
-
Target
c2768f04860d4a3642ead021118cdd9f_JaffaCakes118
-
Size
3.8MB
-
MD5
c2768f04860d4a3642ead021118cdd9f
-
SHA1
8c2ac1bb026424572a7719c798268ac28a6aebbc
-
SHA256
2fc0a1e3bd35229853058a4973eaa74999c17fa120db0babed25f0f1a87edcef
-
SHA512
b81acde3a4f60674fdc7b6bc21c238017f24645f8b48b18104c3d88b078003857c67a60e810dcb248fa4cd71d6e8313fbe56829fcc78aa4942c7bade5ee1ffb2
-
SSDEEP
49152:zcospkUezOYk9dxjZkeVKffn1cVRreOpQ3mlQjL6hL1XNPT+nFP258ROmp3xPTO/:zuez7Kae01URr155DVT+FOKpo5SgBg+
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/1365926436_far-cry-3-blood-dragon-treyner-21-v1.0-dx911-lingon/Far Cry 3 Blood Dragon трейнер +21 v1.0 DX911 {LinGon}/FCry3_BD+21Tr-LNG_v1.0_DX911/FCry3_BD+21Tr-LNG_v1.0_dx10.exe unpack001/1365926436_far-cry-3-blood-dragon-treyner-21-v1.0-dx911-lingon/Far Cry 3 Blood Dragon трейнер +21 v1.0 DX911 {LinGon}/FCry3_BD+21Tr-LNG_v1.0_DX911/FCry3_BD+21Tr-LNG_v1.0_dx9.exe
Files
-
c2768f04860d4a3642ead021118cdd9f_JaffaCakes118.rar
-
1365926436_far-cry-3-blood-dragon-treyner-21-v1.0-dx911-lingon/Far Cry 3 Blood Dragon трейнер +21 v1.0 DX911 {LinGon}/FCry3_BD+21Tr-LNG_v1.0_DX911/FCry3+21Tr-LNG - I.N.F.O.txt
-
1365926436_far-cry-3-blood-dragon-treyner-21-v1.0-dx911-lingon/Far Cry 3 Blood Dragon трейнер +21 v1.0 DX911 {LinGon}/FCry3_BD+21Tr-LNG_v1.0_DX911/FCry3_BD+21Tr-LNG_v1.0_dx10.exe.exe windows:4 windows x86 arch:x86
2915d3f6032c8c65aaab0c305696f7cc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaLateMemSt
kernel32
HeapCreate
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutReset
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 954KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
1365926436_far-cry-3-blood-dragon-treyner-21-v1.0-dx911-lingon/Far Cry 3 Blood Dragon трейнер +21 v1.0 DX911 {LinGon}/FCry3_BD+21Tr-LNG_v1.0_DX911/FCry3_BD+21Tr-LNG_v1.0_dx9.exe.exe windows:4 windows x86 arch:x86
936e24eddb5702db5cd065260b039a07
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord517
kernel32
HeapCreate
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutClose
user32
MessageBoxA
Exports
Exports
���:��2���Nh�~��ú�|�0l����۷j�l����yH`�.��e �ǂ��֘�����v;qd��av�:(X� �0�:�!��4��W��f-$�#x2PtCN?G��e/��<s!SU�x��@pI��s$�[��1Zɏ�� űd]�@'�7�y�dF����WH �?V��M�r�#��^cq +����s�th�L��X~�GU���U�Jg�"Hq���W3�~��j�NR���z���A��r�.9�GDn�� m$�����>��+��� X y=l͏ɺ5���1��{��� ��I�*�Vlw_����ۉV�M���ؾ���9k��CΥ�;B�V�>n�����Y����Ɋ��̸bpn������;e�>�Տ3b5��/1Z9B(���b&h]�[���S� ,�姑%l�'�yxT*���rT�I>(.��5��GKZP�'w�#_�����lR�B+=վ3'pN^+��ڣ���ԑJ�?,�#7��Y0�E$R�q�264Y 6���kހW��/T �#�3�y�q����'[A������_�@.����&e>�ZvI�&/0;��my����u0�\��|_�3�����)���d��ԜW�i����E��ݻ|*�1E�]��z���C�;e�f=�6�ѧm��u>�m>K�<�'XP��������{ۜ�)�6gSlc��R�yT�a��NR7��z�9���:�V����Dt�s�bvT��yC8�`X��jOE���*�D��q�]=H����l�Kr�;��@��c^֥�i���.��%ў�����uW����l4�C��i�0��C�F� ��q��a �Ҥɻ���/U�1s&����`���;*�R���z�Q����ֽ��$ ؞�i%��{�g�{a��맡��/�@�4�J����2����,��՛��\���W�T!L��4lҞ��ng�\r^dɫEK�c��!��&�f�439*�X�1 3����t�͐��\�} ��2��,�ӷ"^[P��[��H��C�e�pN�*�.��q�XeH������@M��;z7}P�(ޅ��h#�Q&�e���_g�LsY-�!Z��H�d��}w����<sܵA��b�V`��]��.�-�@�mv�rj�i�J�K��]�|�� o�H��>�tC����U(�9qbGݘDQ^N^�14����-�'Eh=�b�h�U3I��9��,ҁ0n�i��g2�� �:͊�L<c��BJi�8ȟxP9�i����]�� [������0�p}fj� B�� ��L|����_�>�f���@ ��h�۹����!& �b��v�o�2�*��.�6��Uɋ\�h ������J0u������E��V.<�ȼJ�ڣ�hր�vx��F�ΰZ�\Na6�Z�t�p�Gt���]Y�Z�f�<�["k��� � a��^Ccܻ�|^-FB������ŁwX#�f]�c[R��(���#%K �tz �bTY�U��[m�텳wy�즆�W$��kT��X9��9��Ǵ�w�9P�x�6���YqKW���s�� '$�$��v �ysNi��ί�o�C�Ð���u5����������"Rk����)j���]�{&��LJ���<���<�Ѳ{S�p������22l������rh������7�u5�V�-@:闤��%k1���W��L���`ZA��\v�uJ�[(l'G��n|�Ƥk��5j�:(I\Eac)bl�H�vm�;�������\C<�K�8)��M�xu0�g�����^�:�Q��tF���\lV��]~M2�b���H@�Q�j@ui�p���?&��Qi�3��An~{��ƱT�6��87X�q^tgB���j����ŧ���%ir��My0$�={N�a/�r>B&�O���β|�?����7��˻N�~q���V���� ֝lS]^�t� ~Ź�LRեAl�Υ���ቢ�&�DN��`>P��6D�Qz3�KDBdZ��-^�;��@5Sq���B�1ې`km̧x}z�W�������FQ{K�w��.���#�()6T��14�8<���� ,?}�ٓ�c���/U�O7*C>8�Q�:''�!_����.������u���� �pY��� �Lv]tw�LCo�Wd��q����7y�:<���5�bl ���)[����iZ���D2�z���U�w~����^�M�(H'���,J�b����� ws�Gdyr��_�^�5N�6z�\�#��̚�����<�A�)�$CS|��~A��PS�W��b��+���q|�;�8rF�O$����B�@��e1�� <$I�Y|x��s&�"���ddN�r�<g�q��l�rM� *W��*=�5D�GNq������n7Òb�7�^��9����=�fPȸ~�9�'��>�p�խ�Ƈx<�~�b�����M�=�^G�)��*=�'�֗��f �/<�a\��3i6�U�~�,��_H�0���c�O�S}�Yj�0(��e`G�C��������<C$��O�'���7@,�_x����n�Ï�-C������]�2��a�n��T/$�JB�&u�"w��⬭J9�0_���=J����ؓ+���)3�O��#���C�0��O�g�-O�,���;I��R]&Y�j�~w�R��tg��FY]��6���)�R����t!p�������e��N,��f9Tv��ǥ����,C�L�=��Q:��:G���R�������`���! �H�*<GF;Ɇ�Z��B}�詵�Wa�9���*!@Z����1�#�-bM9:|�m�y2r�ⱎ Y��r�}����ƀ��ĺ'�C�T���D#�iDs�� �6���_QGw�,��g�>�z� %�t���,P��T���b����*�����E��k4M@Ƽ�8<ID�K�˞�)�����R��@1P�D�5Fp�����w���*+��� #6��������R)�J@����xQ�����@��m��[ L#�rT����n*>��T���N����x#�w(�T�L��5���r�j�t�XL�k��ѕ,NWmֳi��
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 954KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
1365926436_far-cry-3-blood-dragon-treyner-21-v1.0-dx911-lingon/Far Cry 3 Blood Dragon трейнер +21 v1.0 DX911 {LinGon}/FCry3_BD+21Tr-LNG_v1.0_DX911/VERY IMPORTANT!.txt