����� w� ���.ʻRJ}<I��T%�⁊�҅�w;��R�?�oI��AmS�Q�6���N�s�Yf`4��y��@���Kt���L�,<J�f퓭�E�*2ڎ�B���3,����u�U|��.����nS4������PI�������:�|`�w�L0�n?5�ݴ0a5T�b�t�q���|D͵�N2�.,H�k�洓�OZL�p�[i�������9C�¾�^�q5�h���������jW��)6���Y��]��L?n����)��دgP���5������ſ=� �I��p]�J�0X:����;���H!<hi�<�Rm��|�<��Vc� `˾�q倐�SPrK\��+]~q�s�2�:�檞� ������ b�y��4h��\�_���ݤ����D �G3�J&�y9�z��L}���5�ƙ� *ƤN��,��=��V�S��h�5�#w|���%��K���?��ܙ����ʳ��8ǟ�����ଡ଼/��_Y�|���O�df�1K�Y�{k.� \��G�Z� Ni. `zV���J��1��Wb������P� �9觧�ug-W���X��z��������E_hR���<��q��0��{����V�Bo�D4�<���E5�!���r�K�Gw<���� J����M&l��ohîe`4L�c�^����u桎�b�wz]�u�.��|W�n���1]V�e59�����,���)ڒ}��mu������jDc�z��~��|���Bh|/S-|�7e٩� jKp�f��4�$2H�m���:��U j��mUxI �Y�7QO�=(���4��tҰ�}�`���!��;��?T�ne�v�A�m��.*��Eyrq�g�?!��(�0��"n��=�����&/�V�2�.��t����R]'l�N�d���p���9(;��ER�����Kv�FRl���P����q�K||$L��|j~�_:2Qg0&���4X�r0�����q��n�!h/�ǀE�U��}�z�L{,8��C�/9r�;µ#�op&yY��JJFD�m�������`j�X���G*c�&� 4�zO�!P��Y�|(���A��k������ZS�_��Nx�u�����Y�ظް����+H�K�IFr ��r����Pr��� �fR�xL��tg%<�@z.�!<��m�e�E,�VWQ��|����t~���<�I~�wR��,��G|�Z�+I�qt��M�.��;�� ��=J�݁�0M���{�M����G�p�e:0��Nr���z���Řm/�aGO8�` {,M�C�5��i�g�<��W1N�O�b��H>��͆�x�L��� z�}�CS�{"S>H��/���r��ڪ�;iPi�c�պ(��k��ٰ�<���s�1�)�R$�I��A2md)����rW:����#v4�Xȫ����*S�a'8� ���W6� �[%�T�BS����%mq8/�t���"��?1r����w�` T��G���f�[�������ր�a��h���16|�\A����� E1�Ax�~�9U�e���O�I�$:�|X�>����NkW��O�[�(ݯ�E18}A�PI��᱂x;� E��l���5���������U.,��W�L�ᮧ�Z����Ӟ�U�gŲW���t���6#����0��x�h�0e�t<�N��}|�.��䲕�_tAN�l���z�pݠ�C���K��׳@M���z���7����Dou�e9��{r�p+gFN0�r��5ϺV��M�bm̲�vꪺ���܈i�w-�ly㮼���u�,*Dޫ[���0�@D/����"��� ϵǹ.��_����d�L�����[���Ja�&�h����֚cՉ��x���[�3Q��:t4�'>7�7>�!nu5k�1��=�|\@�vusPK�m�%u�\x����l�f�5Ds���ig^̦+�/g� ���;�"�/ʖ�C�1_"���.\U�����n#%錭42I�d�H�J-�,���H+��-\�9\����Y��`���ZW@s��=ܭ���\���*_�"#��Կ��Ϣ�w�K9��<�<8����ZQ�Ԛ��[���D��̍t5D��"BQ6��1(�ʤ�:��j���t�v�4�� s/�L�!10�����%�3/����f|��&;ed܂+S��-���[��vom]���ƛ#˥�{9e�U�r��Q�D��Hu���Be=�>�CJh2nm���1M����*�212L��#:�k��(�b���e!,hd��^z��ĉ͊�I�� �E�m����;���/���<����o��q��iOz�����(�٪�2j��?f�!�!���ٕ�y���=�8VMOz�|o�1��Z���S/I+x�J�v��6�r2��G�_E��"T���o�+�� ��x��&Yf@�"�H�&�Z�߀���x��������Q��e��9������Z]b|w���Wmk���� ɏU1Y��#��o���&�r� ��:I�g��\���F�"��7_�E{���)<�$��ت����P�^���:\MP���1��F�1�[��$��e� ��Q�y�<��{e.c����7y�����B!�o�~����Q���+�{/�@��ƅm6��S�W��{�YA��ʺ ���%�7��=��]}���>�$�u������H�[ R��Iȭ\�H�#ˀӣX��(b��I����iT!p���ي �ؕ#�c*��?�%Q�����T��� �u��ߤ:��$���gkcj��� ��"v�L����\q�Y��2�Y���fM�-���C�{��ލ�^)��QZ�M�m0����� �g�ЄF��Z����}�)F���%q-܃�Y�UH�0��ߑ�.��{�^;��Ha7`���O�H0��������y�`�И'���Y2�49�\B��+�R2����zX���`SFŦ~vvu�H;� r+X�4���"���k��pN!��=�'�½�j.4��$&��8����^L�T�w�}��pm�MjAf��5�f��wԱq0 �?o ����v
Static task
static1
Behavioral task
behavioral1
Sample
极速软件下载.url
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
极速软件下载.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
狙击精英V2十一项修改器_Jisuxz.com.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
狙击精英V2十一项修改器_Jisuxz.com.exe
Resource
win10v2004-20240802-en
General
-
Target
17847e306863b7915185be33c6517e97_JaffaCakes118
-
Size
1.9MB
-
MD5
17847e306863b7915185be33c6517e97
-
SHA1
1edf6a2a67464eaa1897a5ca441b4d163af4e5df
-
SHA256
3884d8e8e69899893373b6b63e54400020c511ab712f0f8ef42bacafb4f95dc9
-
SHA512
fac719464597a271073b9e5b79781ed05ae8b5266200a34a4e0a21cc5eaac8d7adab63e1b58eb4197f1dea20cadbf7791fe6df3b6684986f24d3086f546ed753
-
SSDEEP
49152:4WShVmOf/ii8lHt1po7NR3lCcOTFFv/sKqXUS0LozX:5YcOCXS7NR8cOZFHsKqEVy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/狙击精英V2十一项修改器_Jisuxz.com.exe
Files
-
17847e306863b7915185be33c6517e97_JaffaCakes118.rar
-
极速软件下载.url
-
狙击精英V2十一项修改器_Jisuxz.com.exe.exe windows:4 windows x86 arch:x86
ee7e047880ca69dbdb08aef3fe7e9ebc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaLateMemSt
kernel32
Sleep
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutClose
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE