�W�h��ѿ�[I�y P��~ � h�f���� r�_R,B%>���p���d���`ד&�#�V��3��)<o� ���"��u�L_�Lj�������j*�����_3�U�hV��@.Е�}���Ը'�����P�"(x��+L��;Ɏ�H�!�rSs���P�2N ��m ��&7Cvi�@�STYC��t���C-0K݆o���߷v�YR�ƨrq�Zba�Q��A��J���ST��ɔ��/k�p`�?�����W{��ܰ�rΞ�� C�3���#ûQ��I�P�xA� ��)6�ge���F��\�BzÌ����: hw����S� Pr�X��r/�Flx��RA�N]P�>e�O%�Έ|�\4��nl�� �����/7:̄������q3s��v�-Qx��x �i��1��QIZQ����U��I�>�)$!���{����W&j���(�0��Sn�U[�JrXG���I ;���Ah�/�ϩͯ0R���HХ�:=��'����ߜɖx�P4���b)����TqO��\���6|�z������k��:���@P:���J�����OT����b�q��o����i�A3����L�p�"���:I.�<�R��ngMO�Ol�M�[)��ʹ�6�a����q,*^l�^�SL�@g��=b�A��HP�j�:��#�q��_%�GIm8�0��n���`����l�{�w%�A�v�-��p�o�4�b�g�A� l���jʎ���� �ɢx����s��fџ6B��Y��[5��6���T%%�4�j=��!��Ok�C��Շ7�N�Fm_�#%��\����#��J�}99�&c���%�A��;��8��A�N1s�<`Ƣ2�� ��Ǚ���{�?�nuږ�����4���I#j��9�,��-�.ϲ!���>��!_f�� ���8��x�M:|gh���4 2��YqM����W��ŏ[���Ғ�qd�dx<�9�]�u[=�+������}|P2���t��*m��m!���%�7=�H�M�iD;��r����qc,.�4���s�ޠyG��A+R.��n���N���XY���S �<��\9�6-C���H�\i�i�+��rU;�£�$�;����46\�\�*Sʴ�� ���sʯ�2B2�<��E*{_��̵���,��~v_zg^b@M{���;-�Jq+1pR '� �8>�C�p )�Hy��>��K�4��9Q���T��Qr]��L�4ma��#,O~ 4YPX[A �˥ ���f�gV�+���Z���oK;�~z��Y�-g,����cF�üpu�GD%�W<"��<.#���_�s��s�ۈ5�e�jZ�z,&P�(�/)&���Xx#�W��5�4�b�{�f���>/pj������Ikg�N����qр���4t��czV�i��\��r*xx�ݭ*'U f��~��cuOY�k!����u�<�e2����,��f��l;��Xj���o��c������� k��A�~�6��'�]�͔�f�<��M���ąs�ς���U�LB��� �%Ԙ܍$��}s��W:ˌu����~'�+v�yB̸����J�IO��$�����%�H�{ v�hBL ���L�Dc�|��~���|�����������Q�Z;/xޑ�A�@��0";�v�<�PN�N;���N�ц�*�b;��� �����i������e�W}?U��� ���x�_��J����|L OgEo*(c�c�/���v7�:F�M7�`k�v�'Gs7��}z�[������uʏ+�I���8g�z��o� ���,ݿf,���n��Lb��c��K?�$��N��|��܉� �\Х8Z�s>�_A?1)d�b�mʹ�V?#5��S���_�Xf�7�m�����2����91ޔn�fs��,�*���r�!�s/e���b�ѣh�v��������s������A Cj#�ZI�r�0��~����>wa<�&��s ��<� ȿy�n�z��1Lʒ'�����:mJ�:��˵��x~��Q:�����gB�� �<: �ԙ{����R��l[S��Fr��O���ELE��z�bJ�5��� WFr<�9nsw[:�j^�n���jf�*����L�@I�t���]��=�C/[&ۋ|$���q�� �@�X1-4'�-W�_:����b��O�X�i�Ύ�:#������At��'�p���a�����Ut�!AD�nI�� ���)Bc�ז��<��9�T�K�7�g���j�1,&�u����|3���Ԍ�to�lO�?_H�xϽ�B�B��y���{�k���AK�뤳��� �|E|���JS:�<��՞P�����Rl0�$�/���[c����_E�|�����|D\(�V��)<��$Jz��s��2<6�D�nd��s��y�P\L�g�*S㍈6��ҚU����?�|��ek���a��ހ���:��68���AmǴðX��GMI��,G���7c2�.8���[�yZN:�\v�J6Z������'����ج�mg쮘��t�32���}�0S���lh��yu� �!�#��zﳙ2���g���`����<�+���4�{��b=��ZS�?�/�vA�u��,ٺ���e��6��B"����}m(�Z#����3�729�i<�Qg r�0��+�;����Vգ}I�!*g�5�S�!a���h�G�:���H@���?D鞻'5p��G�3y��]N?���Yw�{��/�*FAb���h��Ňo@�<͈��i(b��e�����6����!-��o�Y����O`��&)�L �ࢲ=�1p��Bhx4&꾃��S�"�P���c�T�`ef��ؒCn1*#������7��ß���N����[Tx3����t/ >$�+��'����#b�����P�s��ȳEkS��~�{��ܶ+�i'��D��;u�/��n(��綃L����^�#?g��� {�O�+/3�_Y��u�t���-y��i$��}3'�l��/T� W"�ϒCOѬ���ں5� � �6LV%�r� ��_���G�!�
Static task
static1
Behavioral task
behavioral1
Sample
Sniper_EliteV2+10Tr-LNGv1.14/Sniper_EliteV2+10Tr-LNGv1.14.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Sniper_EliteV2+10Tr-LNGv1.14/Sniper_EliteV2+10Tr-LNGv1.14.exe
Resource
win10v2004-20240802-en
General
-
Target
dba4c72a1ff001d91f86d1ae765d73f9_JaffaCakes118
-
Size
2.6MB
-
MD5
dba4c72a1ff001d91f86d1ae765d73f9
-
SHA1
9b7a8decb22c9d05ef9365a515cf620cf39f2041
-
SHA256
ffc41b1da0d7b621b59c62ba545c240b7359e9abbde1dd5efbbcfa54c18ba147
-
SHA512
d13d7f7d2b5238b9ea2cabaf7d83774f3aeeb764cf3c7101961c7b4a0f20a4b85ab0cbde529aac0d824af709641c57a4bbe88f858690e05171039418871e04c7
-
SSDEEP
49152:iMt5zi5xFPzF40JjmHtynkL77VKyKJnDI8WxIi8hL7JtVSk4iedfLQn:iMu5DF4OAEUBKJnDI8W3mHD4i6fi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Sniper_EliteV2+10Tr-LNGv1.14/Sniper_EliteV2+10Tr-LNGv1.14.exe
Files
-
dba4c72a1ff001d91f86d1ae765d73f9_JaffaCakes118.rar
-
Sniper Elite V2 трейнер +10 v1.14 {LinGon}/Sniper_EliteV2+10Tr-LNGv1.14.rar.rar
-
Sniper_EliteV2+10Tr-LNGv1.14/Sniper_EliteV2+10Tr-LNGv1.14 - INFO.txt
-
Sniper_EliteV2+10Tr-LNGv1.14/Sniper_EliteV2+10Tr-LNGv1.14.exe.exe windows:5 windows x86 arch:x86
14e1614f4a9492854843d9ab6ca45476
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_adj_fdiv_m32
kernel32
GetThreadLocale
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutPrepareHeader
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt0 Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Sniper_EliteV2+10Tr-LNGv1.14/VERY IMPORTANT!.txt