��Y4�O���ǣ���a��n%٩��O�B���/�zW�J7����������a��f���Y�RWj��77���F�V�qX�����iI��u���~�Ŋ˺(�s�"Li0}�ElHvc�Bw?;�=bЍ~�:�x��^���c�85�@Ki��L�!D����{WD2��4�)s�蒟�xg'n5�3�?wɈ�$$���Bv��#��>P�<��d���Z��i�]cxV;�*G�G@}-iW�=ŋҤ<�O1u��D�tU.�S��ˈ�y����^6��hYy/ ]��S )X�z ��`�F�?)��e��7<��N�X������z?�R���K{ ռ��2� `��5��*�( �3�}6F���� +�3����F5��~�%'Ct�cV����� ����gh!���"�����>5�w�|O�O"pz�CF��b�h�ם��K�Iv��gB���N��p�����S,�MvW{�>���/ZL5I���� ��p��7rVP�����ܑ4³��uZK"�zӢr0�d�:�9�_�PX.���r�v~�*���<ݱ��t6�p4 Y�l�i�]�����\`�O���+q�<�ׂ�l��]����K襍p�\��b���U�G��a�UM/V�]J]�lj]7S����-&#.����?���.OhQӢ��;(F�����m���o���="\5��˵���,J��:��9sd����4c�N2x'��J1��H���G�f�}5���C��zj�ǐU|EX�:n3Gi�������/@�zu�ՏaaO�\�� f� $���B�0�P�+�Cj.�6��5^ys�V��Y�S+����g6��EHP��6�[(� �vκ��5-lS/�E��ƫ@Q˘IP@ҳ��a��w/�s�%^��?����#���]�g-uu1&U1��&&�������[w̳�m�,;>�Ќ}�p�K��|[��!؉LOj��'����-���္��� Ц����2�L�H�[��<��$�/+����Ru�h>С��MՖ{D����E?���h(�V$���ޒ��r��t����q�I����K/Z��B�֞k�L�о6&�Q^���8�$e|eNG7�U5��86�6ZKS!�̊�O��?���:%d0�&�jVf{Ha�������Qh�W����q, *N$v�px�� $�]�57ڋ��|U��ךzb��=)as�EŶ�`HW6w��>3^��ӡEcu�\��v�o�Y�K��2M�:ڞ'��B�C���YA�4�Pq�M�l��+�~zx�RĐ�$�|���h:�md�д��M w:�ֹ��M���iW��M�ah-kfހ)RB�3����# �S�n��a�fFIR�w��\�� n�����[��U~p�xp���Է��U��-�;8�9P��1�Ӗ�� �[h/D��U��+�dr`���ջŲ�&ĸ��8D�۔� �Ӹ-{�Z-e���lT�y�ϛz����D pKErjh�>�z�f>�q� <�¸����N�_l*�C2'������U��n�qT�۩'�+����(.�rO+k���UP|��_-�?�.����Cʮ� �˯e��uzV�Q"��}�G���Ea��j����O!q���D�����������_�x9�lhÌe\K~�a�"6��<��~�c�����8GU�,�plʭ�8���J�'u<q&*nB�l������y�_��� ���x� ��I��� ���6�t���8���)�뵦9�E+��'_g�BARb���%F�=&�m�G��i����V3��S3�9y�X�� ������v�!mD�����CN �K��O�Xm`)�_RKY ro�y������ Z��&���O�p����!�<���0,Y{��*x6]�f���.���)��� �QdwK� S�']8�y��@��~�8�QT<O�V@̭U��{��CUM)yR��q������� �~�|���/N�=P��=v/'�Z��"��1W/2�m�-Yw� Y���� �;`����߯��@�Y)�Y��������d����f\V� ��B�t1J����XP �o�� �{��[r��:$����l@��Zˬu��(uy���*o��opl*j�$��'�P0�mk*���Y��a�U�.���Q��~�v���Ө '��B���ї�A2~�t�1��NnV���y�D,��#0��u[L׆�Y�����nI���!�v�E��!Ϙ�۸��$\�m�z��8�it���}/���H�)1u��6�}�DY0��v�\?�1���PX }������M�-�x�x!�2���Ҙ��� Q�f��}O4if#� %��ӤP ?s�U�}�_�N�F(ّ;�IN� W���z�'l�b^���ŷ��2ӈE�j����95WMW \/m?����n�.I&��;pw�Q���c=r��;X*�v}��;թ����*)w�[�h,^ U��v����Xۊ?��Qރ� (�+'r=^w�1�nd�1B��Z�_�A��`�G3ރV��P�S0��L�`N*0e�����2� 5_�q�r�^$b�U�r�?~-V2�ۣ;R�fߦ�� |n��S�CZ��fh�R�%������������q/��N�{�285ש����(�4:�,�1�'�v(��)��Ħ�����wx�4�� �]n��SjQ9S*8��-t�M�g]��Z�$�5��s��|����ָ��>P�!@6N,D �Ps�jO8��Fɝ9�H ����J���f"�=����N�<ߪ}��z�9�dS�ӱs��{=� ��ńu��Gzq\���d��ж��v�� (���(�>�/����L�hoʰ`��r�Zݵ�_FMC����a�юn*�풺r���"p�c��4g�5�����Tѳ��|�e��7{���?���m�Hް#fhv$46���� D?S��ۺ���]�x��9a��m�0����l��n��u���B0���aZ����xڋ�L늤��X�d�j�w��W�/ܾ��SK���W8�0��7� *2�I���G���"⩇ӂ�]�ku���%$7-��h
Static task
static1
Behavioral task
behavioral1
Sample
BF4.13Tr-LNG_v1.1_Origin/BF4+13Tr-LNG_v1.1_Origin.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
BF4.13Tr-LNG_v1.1_Origin/BF4+13Tr-LNG_v1.1_Origin.exe
Resource
win10v2004-20240802-en
General
-
Target
e0bbbe4732751323fba85d0ce5d3efe3_JaffaCakes118
-
Size
3.2MB
-
MD5
e0bbbe4732751323fba85d0ce5d3efe3
-
SHA1
01bd0b77fb9401aef63b1bdeb420032ffb701381
-
SHA256
14a51c853214e61b13c268f3b432c2e0abbc5519ca6893bbaab64f33c6c894dd
-
SHA512
0af464136f3dabb5891087fa29eff8b4134169be74dd58b531c26795d1b015bac2a9725c6f2021696b2aadd51ddb8b675c5dad63642aa92d055588166e949900
-
SSDEEP
98304:Cg/70ClG/py3Bq6MosovcFoQKtsRw9k8e:ptQmk0kFstsRw9Y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/BF4.13Tr-LNG_v1.1_Origin/BF4+13Tr-LNG_v1.1_Origin.exe
Files
-
e0bbbe4732751323fba85d0ce5d3efe3_JaffaCakes118.rar
-
BF4.13Tr-LNG_v1.1_Origin/BF4+13Tr-LNG_v1.0 - I.N.F.O.txt
-
BF4.13Tr-LNG_v1.1_Origin/BF4+13Tr-LNG_v1.1_Origin.exe.exe windows:4 windows x86 arch:x86
1f33e081cf16108632d11ca88e0171ae
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord518
kernel32
HeapCreate
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutClose
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE