�o�=����bWba��h}W���N����.au�Bl��-�Fcj�HD��8r����*Gw#��$�����~ �%�xkSOĔ��j5�$����-��Q'b�����w�����D�~���~��<0Q�����RI@� ��Z@jc�Db��w�+FM��ִ��a+�A�H �*��=���������_���2"��D�|���eqj�y\��a5tq3.>gB� ��,�s���&k��Vn:ze7EW���{�6t5%L�'l��C���>L;�C?7��8sҐ��᭣�:ݖ;|�C.�8�'�U�����w(�V�E�L8�3 ��Ow@�\yv�T�Y�:u��������.�OJ�pc)�������ˁM��g${(De�q�J����9"��mÙ����4br*/^��o[ �:(��8��Xo,��}�a,^�G���W�� {��L/T_�C�uXJD(��D�fI�"����IY6���(����5g�WQ�Y����|S��Y��+�����9B���[_у�~�΅W�Vv��%�ׂ�^�����d��8�H�&��$���" :��z� �����w�$L;-,o�.���{�څ�����6��}3S:�[����E��k��$8�gu/����32�h �<�DX{J`������x����5�\��P��rWx�8j�K��4�H���`���X�����0�<WW��3��� ���8�[���9�k�:�����D���ߵ�,��\ `���}~J����#r�qS߂9Y���O|m����'��]s�}��>�����e�Ǔ �EL�3����=�k.�p@���wm;CX�?��e6�Wir���E,{-�,b� :7"s��İ�J���&��;P��u>�{(���O"!%��#��-��c(��M!������Dt!�a�A4�-�T?�yV�N�vhA�ܰd�i�b&���?���D�&���C�7��������1ͳ��H�ũ�<Lm�ڀ���?���{I� �\���՟��F��Z�=��Gk�����E����k��m"�_P@�O�Q1�X^�,auIί��!����[�����N*9�F�� ���?I^@��;L*v}������e�h��`�[$�U 8�.���c�����*]�<���ū������t%�����&��sv��!��q�G��8��������� m��.R�Y���c3����Q[��^G��^,y���g�P�K����{���EN,��9V���&OO��k~A������):Zrk�=���`ӄ��@�r�+Xd�W�c��mOj���p&�E@1<��C(�]L�J7�"��a���nY.�T����� ��[�@ʛ�sO�` ���(3����{����$�Y�{.Խ�U)-/��U=�`J������a��P�4�S�֞��� 0W�Ul�ʹ�KG)N�������\(�U��-;�J��2+w�ܱ@�{�y�k!��X&5��4�3�¥�hB��c-#��r�B�,z0|������Q�y*�,����<N�V�h��`��txo ��G��������!]+��b>�j�U}�T@^z�"wxw�KVzh&"K~�&�V@k�ָ�4C ��ND,~(��I�Y^���F���f����:W n��d}3�p�9�Z���eD���|9�J�;�|��}�xe�a* ��IC��@~)�⻐ڦu<�����i�E W������{ü���s�s>��=d��Nr�~;ԛ����s�D��AJ��d�<(V��}���!Q��C��»Y��c�Bѧ�b=�I�DRX]��ֳPp�g#8 E)p6h�#�ʝ�e�S�M=��J��-��f�>F�Joq�&��g��q��j�2�8K�;q�g:P2|��yc�/��3"w����Xj��8�>ħ�0��Z^co&��?Vn�>�Qc �����%o�����-ܶ�`�4�}e����W��G~��~؛l?�{K m���0ka ڦې�#�.�waQ�P���1B%��M���o����p���߹�~ʬ�?i.�̥Q��RI?7�_���Xk"��;t�j��n0�RM����ٱZZ����v^@��{���=�{�ˤ�F����Jm���ct�:"��B�X���b0NQ��~Y��4)��Ҏ9[���T��� ��R�z�)x�Q^]��$�-�z�"-N���䥋�/�(�`v��"�>;9f��@d�T��a�����g㈹�j'\lb��{�Ӟ�-%��;sh%��f)�����SD��T�'S�a���α3������^e�+úB��ͪ�8)l�zQ]�|´�w�Z�B�fʆ��T��@��ƽ����f��DžW��C�V�<�?�@�c���t�ź�v�8F\7:�@a9����'��������{��K�0�|g���0�p��=ߍ� h�`:�b���{Y���l1/M��7Q`MPZf�v�p^"��-#weA|P��5��Ҧ>�[A���H2�R+�%�� �h�FJkx�Q����P�~l�;<Γ��;Tz����c��m�����?�DJc�gp� b���=# {�a���X�Fv�梡{o���3,�E�@:ާ��H��;��B\P�Hxz<5�� ���9!�tK5&�з'(d�{��T�P��Py���b�Xp`�����KM��B�V�k.���y���/s;;��a�D���d���pF�����Ҩ�R�)���%5d �u��ʳo�y!i�7����n)g����_��"��,�&Kb��٪�Ǫ&�߷'mU=�H�4����N.��haʠ�F��]ݮ�V�9��|�<����0�u�ېMG���C�w��OO�L���.q�y�2ݒ�8}���������7�_�.'v�9��%�Y�4�@�^���j�jv�=���v�:y��|��Egn@V愾�!����C3ً�?z�C�y�u�J+Kk}�M�%^��s�*��N�rD$�ߤ�nc�H�c�]ȡ�@���y�5������zQ=:�����"��m���-.����ƴ뛑Hٿk ��Ҙ�%����b�0�
Static task
static1
Behavioral task
behavioral1
Sample
ALI213-SaintsRIV.11Tr.LNG.v1.0/SaintsRIV+11Tr-LNG_v1.0.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ALI213-SaintsRIV.11Tr.LNG.v1.0/SaintsRIV+11Tr-LNG_v1.0.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Readme-说明.html
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Readme-说明.html
Resource
win10v2004-20240802-en
General
-
Target
084de9e4383bc9247c733faded7c54e6_JaffaCakes118
-
Size
2.2MB
-
MD5
084de9e4383bc9247c733faded7c54e6
-
SHA1
ecfcca63515dfca568dc6fc42de4fe3000eb7503
-
SHA256
442c0032f357020f95d9587d85d1983f838e53475b18c79b61b76f790ff9d12a
-
SHA512
9b6a216bff29dad37c5e9d4130abff052ee36c64d3d2e4b17122ca57469b98b51a15fa83cfcd6e7639e43109d73559688116ce2966ea4183981c929f03681dd3
-
SSDEEP
49152:JM/uGwjz0keUJkGsD8H1vm+IK85qDnmQu2XUbK/fqz38FDHf6D:JQubSUJkG7Vvm+Juqb9u2XaK3qr4+D
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ALI213-SaintsRIV.11Tr.LNG.v1.0/SaintsRIV+11Tr-LNG_v1.0.exe
Files
-
084de9e4383bc9247c733faded7c54e6_JaffaCakes118.zip
-
ALI213-SaintsRIV.11Tr.LNG.v1.0/ALI213.txt
-
ALI213-SaintsRIV.11Tr.LNG.v1.0/SaintsRIV+11Tr-LNG_v1.0 - I.N.F.O.txt
-
ALI213-SaintsRIV.11Tr.LNG.v1.0/SaintsRIV+11Tr-LNG_v1.0.exe.exe windows:4 windows x86 arch:x86
f1924326c50547c23e32ee93d7f5191d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaObjSetAddref
kernel32
ReadFile
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutOpen
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 952KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Readme-说明.html
-
游戏说明.txt