{�ژ�r�C�0�n�}$��gd�~uW&�~�15��@��K��f���`j��C`#FglF����r����q���'���an�4F��R�(q��<I��5<]y��)�諿t���u�jR��<~Q�l�W�s�X�3��XJ =����c[���d2�{%�%���@��K��l]D���|�;,|��(!��Tj�ҋ����q�ީ"����kB(ۮ��pdAӌEr�ގ�$%0��p�?���� ��Ī!�sG��ʡ��@����,�h}?�Pys���Բ0�DWO �YE��^���kU�ؘ��d�\��V��s��R˝��`5�1-��y|���ϧq��(?ޢ�_I�U^��ʜ�z!S3���@�`���xQ{p]fz�{���WY��-�Y#� [o����;ď�"Q`�e� BiϓB��l!5|�.���aYӺ瞀��|�f�>Q������ɆG*4�4�؎Z���i��KkLJb�1l�ɰ�c�!�<l+��8�~��n��%�H�(�����3[/�j� �^k������/(���뜄�v׃��-�<�ZJ�0�~c��Mkp^FL��������؟Xg����a��h��{��r,n��œr��S#�g��1��k?` ��i�R��{^�ygb���1IH}���. &�O�CR���&�_b����A��6�~Y 2:���]S�}q�w�u����·��sh�܋5~S�Ak�������@ m�� ��pv����H��?=$D�:�@��Z��%;;��*�Kx��ێ�.�͇g|���W���F ��m�˶��:��1C����j�jD��E�GEG+��@�����+Q|�sf0-ۀo�lw�:��*�aT���ֈ���:�y���md�z@�mw���d�x�m�9C��tY�ߛo���H(Y�|/�ϸ �'G-�VY�nJ�� �� ��G�ɪ��\�f8�l�F��nn���^���M����^��v�(t�t���ǖ�D`��/[�E�>ͫm�V�����G>����������W�=���;^�6�Ir��s6a|l s���y�r]�!D�vp�vV�j��4� �����g�����2͊�`KeUq�8n��%sI�����4y�{,�BF�p)����9A��l�8�Wai�ް��d��d��%tl��������s_(T��C;�ʣA"�-�|��9�J�ͭd~J��p��j��©����H5��7��@҆g�R�{��_�8J柪��'4}�f��ʅ�v�/ ı-䵧Ǩg�ui� ���B�FLH��H��:�����?*����չ��.��bL^^���)�^����Q▯�����h�~�5�ճЁ�"b�z�O��H���x*��`n�c�m�T��7�#b���[���ކ��Mߖ�����ͦr��T0����Hm�<�� ��V� ڿf���uՊ'LJ�+���4p�7�b^ó�'��Tf���Bv���ﮫN>!:5��k-���Z�~�:i/w�h����I���F��PĦ�[�@|{��b�^%�,��'� Ƒ�aA�����C:+("��s��������Hh;�����B�З�����[��BT�����rP��Y%��ַ���k�� �^��-���K-�|4#�(�}�?Ng���w��ё㾷2.�ZP���� +�;2��i��To�1��ԡ�aً�rD#���7o�-!�~��ר�T���ϛuYi��$�Blv{���4ٝA���1骹4�p���yƐ6���4M}2��48zt1�זӥ�#�r7<+��.��%0fp��\W�;����}/x��п�3b�$��'"v��q$����Z�7�ˊ� �"7�Z�5�mT�/�M�A���3�������.E�K�-�t����m�0��a�DUiG:�r=�+��N ��Mq��`ɂ0��M.���������� =���ocr���N; dG�Px��Ζ������|1gAꖃ���+r\sW�8��f�iQ�w�'�A��3ri��01�M1$3y�٨t"�(^�� A2��hIId����h���֢U� ��T^)����1k����b%~lt+�*ɪ*�^R����&���o/��F����H]n�D\(;gѫ����T��Q�Q4���5��B�S��ÀO��NAH�lh�oZ���Ql�6�E����W��ɵU%!kq;ȏ7!����g?�r4�B��b�,6gB��̓D��\�:�������-Iav�H��{b�����"}P� z�R��֦|��jU�Zd��B3����[���?�l>����ˉ�u���Ci���ެ��-U�LZR�E�We��5�5�����gC�=�q���G|�Y��p������yA�q�b} |�SD;�t᧻�V�o�k��ʼnC�������q�\}<�k�ѫ���P�&9T a�F�Z�p�#��_ea��{땻�����@-�A�]d��r���:�!�.���)J���F;��!Mߠd��J���>�*D�V�w}r��Jv�F�C�O��QgF�כ�Y�H,O�s���!&�r�ל�Q�l:�B�+k�_JL�#Wa���W�����V��EZ8ݶ�ku(Si���w��)>S�W@X�tE����O��6?����E���9z]��LW��kU`�TV���A��j+�9m��D݃���`�͡���'n�)9�t;���}j]����PQd�8�'E��L��:��7i*����j�p���t��x��y� m�6]����)YrRa�^���Y��P�{TQ�V��3�e�Vbj��;q�T�v�Kn��Y�e���/��椿����Q�]�M�U��\ǹn���R���._�C�Z�1�;�G�>�O�����R��"��u��ȫ�L�NPSa�co�6�j���i��p�e� �� ��TB��|p�J�}� R��Y�T ^g'g�5ਬX�SS�ֽ\���_Y z5�n�}�r�WI\Ƽ�w�ߨ����DtEA����_�T(;�{��\D�7"�+쯦�C&���1o��D�����w��^�W=���o�喆MG�Ï�9�6Ӳ
Static task
static1
Behavioral task
behavioral1
Sample
FCry3_BD+16Tr-LNG_v1.0_dx11.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
FCry3_BD+16Tr-LNG_v1.0_dx11.exe
Resource
win10v2004-20241007-en
General
-
Target
2a1219ef817041d73f62efa5dd726ad0_JaffaCakes118
-
Size
3.2MB
-
MD5
2a1219ef817041d73f62efa5dd726ad0
-
SHA1
c4db180325d4f838408ba33e920f812421f44896
-
SHA256
41c6ef44ad7b85d080f383e92201aa59e1afc74f7ff9d613f1765b4d6f29e94b
-
SHA512
60976805251f257dc623f00c407d4b191722ddfa5a45d2c5446f4925e536741869055a2091c067c8a6dc0c63e5fdebb9aa511b4c581e6acd140ea23deffcd095
-
SSDEEP
98304:rviD1zSlhXMp+eLTMz6QyTdiTiK9OO5MuS8:rvwzUBMIiTDQEei01
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/FCry3_BD+16Tr-LNG_v1.0_dx11.exe
Files
-
2a1219ef817041d73f62efa5dd726ad0_JaffaCakes118.rar
-
FCry3_BD+16Tr-LNG_v1.0_dx11.exe.exe windows:4 windows x86 arch:x86
2df4a3713f222a98881387782101ec0c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord600
kernel32
CreateThread
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutPrepareHeader
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 927KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
使用说明.txt