x2 �6�#z�D !���_�^w���51<�Q� �R�!R��$�����J��1pf���PԒҿO��+��C�����n����{�Jl�b�}'���V,���V�^7N�3\��N �� �Ak�C{��]W쇠1�-ɢuN嵻I������ ���ϙH��D�/V�P_�xJ�H�@��i�X�3�Y�pn�14�D���H���Z>��0���Bf 4�#"�8+�|��!v�R�l�:j�� �G�r�$+a��QQ���C�b��g�n���#�x�d��UQB��A�)Gb���"{D�8\�t���`��.RR;���6"�UF{A�@�C��1�����Z��u����W��T��}��*�p��6�S~��榜�">T��'���Zi�Cʵ���D��B�H��l�id�� (Nt�[֤�z�̹���L�D�*8C/�=�Y��̀{�]�O��5�=t�%��d��+��TIݭ�X$qC݅��My�!gB�K4)�;�0�#2WZ��c ���t�2!��� 3�+� RQN�B�������jl�]�Z*��3�q�P�0˭�Q{w��<�0�1��_y):��]F��j�F��͊fx�E�oqV<x;3跘���2KDrMqD'L��������*F��}��+�p{́ש�AZ.�:;��穇LnD{���[��5���ߪrW�ܭ0��.�8h/]sYV�i����$��0c�l<�T�=d&��WQ9w� ���t�.0g�X� k���FW��Q����!�]��}�O� �4F`����8�� �%7n�}y�d5�vЂ=���d����ٝ���F�/�����b��mX�:�����F�����g�s[cҡoA�d\#��r]f��<�i���@@y�/�ϢdHr��L��B�D�� v��1��_��vntǏ{k�i��}GJjgg�K9��9>���� �Ϙ��d�Cs�g]T ���[u�z�Ha驐�Pz"8s��4x1�������h����>�i6�w(��N�9<GC�4�xي�)��k}��e�Ѓ�Y�T��d�Ke�͘E(F�t�e���#�K=c����pEvK�� �n�uJ ��mP�n�����4)<�/��*�w�U� ks�2�+w��揊����_�Cټ���u�Ktj�7�����*M� W)m�D��Tai[Q�Ca���P)� iłG6xIa���+a���?ꗴU����`��<s��������U�G@'S����66F���=?U�K�lS�"�4�f; �C����v�[S���#_Jqұ���d(�]M�ٺۚv��J��ͱ�\p�ߺnG5ls?�L�с�U����}�;�]K]�&G�ymA������|�?�e�ʄj�����/��A�c�<�����amZ)k�<xN~��3&�Y^o�v��$4�rg��a����|�F���um-�&5H����N�DsP%����S����P�ٞc{��n.Y!�7�I�&̲��mj�|ӝ�,�kXf�珕?�k����}�r��dHsX/R��+�+^.m��3�{��<�S�[-X83R���h}/M��A'��$=�f�� ���LB��_��vc_��>�;��->��1�0v�d��"��%a��]�m�#C���US�y(�~H�� ��1�${hv�}Z(��u6#�yWME������ ��C�����Ͳ���:����o�����k�Qk�5&&���e>��&�7�<� q����I��&�tB�=Q�� 1;&��M&C����O�����m�� ۂ�X��D�M_ך�z��M�˭��ަk�cA�gC6�qSzTnw�^s�/�+3J���ԭD u�19�ߺ+�]27K�����sb�[NF��e�8l\��Sb��Ͳ3.w����bIv�%�u��J�3���}}�c�)�A�dIA��؊�4���<��g���:8� qr0~ƣHga��1���;����!�V����V����&%�FUOE�W �Y�M(t]�����_�-i�k��K�!~����ہ��uдD�+ ]��?��߄�D?B�$Þ��0��^������bdx�;#��5�3h�b�8]��C���<OYvI��#W]��C7���*1�Nʳ���o��@�m���ʺj��� A�b*�"Jl����F���x�/��)K�>� GW�Y1QY �;��w[ n]��d�$�9E�Ex+%��_ �9���!+{;�x�ζ����>HT�"�AH�5�H<Ilga{=�&� ���5�u Z|9>B<b�R�3Ż����5�7�y?sa1Y�f`�����Zfp��c���@�E5fe�8���I�=�k��� �ԕK@����䨍�ߩ�a��FE�YG?�zp��<��q`��X�d(�>.���||B��Q����<2�B��f�Y���Jb��i��#U�����!��9�lM$�{�.��r�x���3ƛ�*#��}��(�En�Fѵ�|�Sȯ�����&�{��x¬Y�t*~24n�D{z��JUg^N�"y���mثGښ���m ��j#��z/�8M������`?��KR��C�Dž�A�V��t�yD�:웃�(F�T�6����*:�e��Y�o�1lCp�8s�\��F���M�_�@��T'жs���ҡ�>!lc�Eu�,In5�&B��R�%`�������?ߦ��f��JN�%}�k2W��������ֺ��_ᚡ�C�N�v�������.���I��>l|}IÓK�E���$���z<�b/�+i&��ʌ��!�P����u��['��7�V��}�/����mu �į��g������RD� Ո�R�\|Iu%�O^d�*��2�2n�ԅ��@U�P4��+���<d﵅ik�2o���\-{n;5֛>����E_e FSK���}t%�BY�!�.NYUM�L����Ϙ������=w���4ٚ�}G�i@���lh=u��9/�D�����q=�����3=JЛ��I�9Fvᄁ�����Q�����C�H��֡�r�p�Ql��r�H���[f����I�~�X̨�N��L�E��F� й-̑��J�d�� �z��7��2�6�D���
Static task
static1
Behavioral task
behavioral1
Sample
52pk游戏下载中心.url
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
52pk游戏下载中心.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
ResidentE6-15+Tr-LNG_v1.2.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
ResidentE6-15+Tr-LNG_v1.2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
游戏无法运行_下载常见问题解答_52pk游戏下载中心.url
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
游戏无法运行_下载常见问题解答_52pk游戏下载中心.url
Resource
win10v2004-20240802-en
General
-
Target
d6bf4f0ce88549fdf241dcab39ebb737_JaffaCakes118
-
Size
2.0MB
-
MD5
d6bf4f0ce88549fdf241dcab39ebb737
-
SHA1
05dd69bcf558141ae6daff51015844f35cffa6fc
-
SHA256
38a185fd1ef40f84fdfd528422d71d4920856beccb34f80cf64eefd409ca821c
-
SHA512
714d7bb1a78b5e2c27e95886d3aa6a3e792b3dff94fb4509aa2d0eab1ed59a3b0b833ef38af2504c535c79c4fd060405b51fb6abe39bd50683f699b8707ce9c4
-
SSDEEP
49152:tEko2jpKX9ssK4ulhoiICUHaZaZzbRUIjD3glAGxzYNRpwD:ukoCpK5KdlPUHaZaRVZjSJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ResidentE6-15+Tr-LNG_v1.2.exe
Files
-
d6bf4f0ce88549fdf241dcab39ebb737_JaffaCakes118.rar
-
52pk游戏下载中心.url
-
ResidentE6-15+Tr-LNG_v1.2.exe.exe windows:4 windows x86 arch:x86
e4146d5f078158cf63ad7b809465ce88
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaInStrVar
kernel32
HeapAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutClose
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
使用说明.txt
-
游戏无法运行_下载常见问题解答_52pk游戏下载中心.url.url