Static task
static1
Behavioral task
behavioral1
Sample
No One Lives Forever 2 Trainer.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
No One Lives Forever 2 Trainer.exe
Resource
win10v2004-20240802-en
General
-
Target
d6813c27a02a21492e642458fb572ad8_JaffaCakes118
-
Size
26KB
-
MD5
d6813c27a02a21492e642458fb572ad8
-
SHA1
40d15560263e6042fff114a4d144556409668701
-
SHA256
3a286f58631f2256c3d114bc376f0cf94bea13b54fbb03b02aa31a9e19724c5e
-
SHA512
25f88bf0a7787751d59455545f0f19f83c9cfbfc0059d2049aa44f1817953f19329ee14a14d0bf5d5bbddf08226d1fa88610520072c2ed04192ba4fb0e11d630
-
SSDEEP
768:ul1C91O46p2FlGqiiFLLAGmARMnI0DHCM2m/nEdWW9uxJs:u691molBi8mARGYMTMb/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/No One Lives Forever 2 Trainer.exe
Files
-
d6813c27a02a21492e642458fb572ad8_JaffaCakes118.zip
-
No One Lives Forever 2 Trainer.exe.exe windows:4 windows x86 arch:x86
dadb335a5e9c6826209531b3457131c3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
ExitProcess
GetModuleHandleA
advapi32
LookupPrivilegeValueA
user32
SetTimer
comctl32
ord17
comdlg32
GetOpenFileNameA
Sections
pec1 Size: 23KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
gameguru.nfo