4D1F��)��Cv�v9Xf]�0�8���^��"�{&�JA|�38O]&�����0�K7zX�5addz���v�X���x�`;���-i��K��9i�c�:Otz��ɏ-YGuW��wyń9�4džh*X��K �O�.�GoU��#�u��5��р���F.���(�2��o�<5�Q����R�} ��2�h(��4FOJ�4�n�,+؛����Sw-��U�4->?Op�7�Q�&���`�㥫d���z�G .f��`T��s��t_a���� v��X�,b0��%��:(!��m2�>�w���(���9�d��DDR=����� ���ߋF�J�k����� �U��Ɋ���6��/�����G����j7� �dL��cH"���:�>`b�xy"��&TC�-ػ���l'6D��`�i~u��m&P�=I���|"�q�9�x?�Df�@�5����T"N0��n�.�0?�J�@���C�r�ʄ�Ȓ��U>ƹ�(O$4�!����>�n�H�d��P壀L��AΈ$n�.����9�ā�ۡ۰ص��(b�X-D�7���̏! 4�d�����=9;��� �T�?p/�$�3{n%W�h� �Ѧ�LR��u؊��[�Dw�2�9Q�y��l��5 :��?*�����T�����\����� ��Om�y�� �Z��q�5��К�9qP3]01b%̼Ne��a�ĭN���j�ٝh�'1c��x�:yc�bטx�*��p՜R����J��w�č����âh+9��;$�/�)$u�2#K"�&{`wJ��DI>��Z1� ��(i����a���y�����n\r (QV 4&#X'+U����N�!���U�?�#�:Nj_�J,��n��##��ĵ:5�km��mJ���F������ |v����70j�vr��s[J�M��}�n_�t� ��J���ie���ۜD3���J6:Kۛ���^�C �M�.}���[�� �xi�UX�K��00�9�� �J��t����7[ �������~\��Adz������3������� 9�O�I���TĈ �s#�Q�p{F\�Z���4��zh�����W7S���\��C Ͼ(`�r��Zۂ�ڣv��g?�?�hЂ��v���gDJ�GƘ�����Y3��F^!T��:X!�!�K�U|�w�"g���b1ۂ��$�ܕHЇ�@aK4s���X���t����ܣ֩bJj'��9�7ײڱ!'�O6��92_==��k���AOHl皏J�ͷQ���Γ��nD�%��a��o��}e�LX:3��}5��4��8�Q��+��3�}`3��:w�ϱ!��n�w�Wj����5��7x����胲Xp�����8��PT�[�k�N�IK<8ЎT�@���\Z�L`��x�G��mb�X �e�� D˯d͏�^BȘ��� `��l�I5�sL��<}����H`,=�3 J��T֨@@��Lt��Rݶ�ۓ�^������v�m�<wƭ >I��C��t����k���؆c(ט�C�$-��E��'_��ؘ�t�*p�;�1YL9��:��1R��G��C)��()jŸf3. ڷ���r'���r���o�G������#��Ry������;��] �ni�O������ՔMa� �� h �4P0���"Ӛ �ClA��3��:�����[����ou���8��6>J���.������h{�TB_o ������@�r#kc�X����ᇢ�Ӡ��%E��ˢU^���_�ޒSo�H���!����r\��@_��i3G ҡ�^$a���� �*יM'dǞ$�U��4�0�dDK��j�,0~��r��=�H��%�I���ͯ��;�'�Z�8��)/�\�]����|�6�U|c��h%z�a���gKPs�+xy_��<��P^�o��O0���];�V�ckjF'Ͱ�W��K˺o.U�N�ž��С�T�r�e<�"�-4�p������(<�Lh�R۸�-E���~�M��;I[bZ���x1��v�a\�N���\�E��IO�����:^L��ܮ��b z:tQ�u)Zڞ������ou[s�q�ъ1�\�kbג_��q6��$�u��p�fe@ՙ�S��(Lhڱ~�$5�]�&�!�O��V����3���̴?� �CM��!~,$���� � c���હj�H�jR��#UwȾ�g�ԎC�43v;��w������I��"�������6�d�9�a�琴/Vƻ��� ��$/o;Uh��U2�^�^��R���v����X�P(sX9�U��[D%���▧L_�h���E�&��rT=r�Q��C�(�9�mB���D�0%9����@� ���wL=�:B8����j֟3�T�L�gC��z������������2t*^���e%*�p�r�)��VEIA�������S�1j>�:%z[�HxD�IJ_+��T���5�-4�����=�=H��a[�2�_=$���4&z�Pu�^�.�ޙ��^{�"�!!y�9�O��� *�v�7���?���F��ަ�K�J���P'2�(��oiy[&;@�`?��/�'6����O��N(3�1�{�٘��K�q}�)h��K�����c�2�0H��|:r؆Y�B�oPR����OÅ^ᅐ�,2e��'�B^�݄�ӗL���8���%-b8�{�G���Da�gZ�E�����pH�w` �'$���"f[*��/�tv+���j�ž"=[Y���Y0z����)��S����uOl���oϠ8Sp�FFt�)|�M��<�Zx09��2�9+S�ɗ#%��3������s��_\�b�|�qI��O���ǰ�+�lstxa���l>����%~q��6Y��|@;��$!X���f�h�|�A��u%l16q\b���^����H�OSIL�n�M�5��K�nB�[�5�4tUl��X���t��IU&'�A]�4B�e�1���(���]�R�5M�^fJA��V��w7�a8C�ـ�@����$j� ��1��"u�����b{*�isq�2��� � �ރ�7O�*6��OD1
Static task
static1
Behavioral task
behavioral1
Sample
3DMGAME 中国第一单机游戏门户 全球最大汉化游戏论坛.url
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3DMGAME 中国第一单机游戏门户 全球最大汉化游戏论坛.url
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
CODBO2+12Tr-LNG.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
CODBO2+12Tr-LNG.exe
Resource
win10v2004-20241007-en
General
-
Target
27545a7caaed90916a70e7ed92f695c2_JaffaCakes118
-
Size
1.9MB
-
MD5
27545a7caaed90916a70e7ed92f695c2
-
SHA1
8223566364f6d98f1ffafab538f14aac06660ea1
-
SHA256
49aac6dd12f476b17b9efbffa6bc1afaba206e4297a7158dbc755df1e9c97348
-
SHA512
b76a0f8c9b8507f650215f0ecf82d278fbff73f6edf1d00e65cef487ce3e36ef2f576500a1779c009550730b5257b94d66f838e8194918469d05dbc2644fb893
-
SSDEEP
49152:K56fzqimFKqqOwO74cKFpGaBjwgnI5tPzvaTwm1y3kcwSkvMVsqDJS:K5o2imQqvwOscKF/sgKxzvZwRvIsWS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/CODBO2+12Tr-LNG.exe
Files
-
27545a7caaed90916a70e7ed92f695c2_JaffaCakes118.rar
-
3DMGAME 中国第一单机游戏门户 全球最大汉化游戏论坛.url
-
CODBO2+12Tr-LNG - I.N.F.O.txt
-
CODBO2+12Tr-LNG.exe.exe windows:4 windows x86 arch:x86
53c11e4da8f4ae99e5c226095a5632fa
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarVargNofree
kernel32
CreateThread
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutReset
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 927KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
VERY IMPORTANT!.txt
-
说明.txt