ĺ �F,��D�����x��O�:�ג�ei>=ԁ����.;�76��(>���|���������ѥ[�`�~�+ dw`�`�����D%����L��2vQ �'�&��������,�7AR��C��� X�����c0������}�Q�o@��N�Q�T!;�,�:����%/e3I��a���mp��7��.x������٠ �4Et ŀ��&.�>*���g����7�O�ו$���DŽ>oɢ ��Weu�_g��&�����́���c�A�d��\C�u��C�E��B{����:���nơ �uv����_>�a *.oF��� %D� �o�G~ ���4'!���!wPh�'.��w4����Q�qsqe�$�ob���v��'��<'(F����Q+�4��m g[�1���ԗ(Ǯ_�JX�o92o_L��cULX�b� ��D*����a�%��.������(�<st#��b�B��rە�=��̓/��M��0q�X����6�6����p��4���E��[?��abL������=��5n����`��/(y�(�u�q�~e�& �(��r�z�lXX�09!�4�H�8+�tI,��&�{�B����v�9��Ui���\�O���V{|��S7�S�y*��b�=��&-'I:"��}k����Qi��+� �J�tg�V�c�� ������o�X[��(��M7Kv:S٢La����3�Qoꥫ��m�:j'0:�પ4-wՑ�Z�y4�x���S�*D�"�+7V&4W|۳��sP���s�<�A�� ���"7�SH����� m�"�O�q��?�W�֛J �}: ����-��Ҝ�U-�=n���u�`,�g��-�1'ඐ�$'a��t�I�ݢ����*�������DLևh����M���Jg�{x/f\W�9�L�c����Eē]�'�w������/��Y�J��7ΠFɢ���u`�,���� <��O؟`E,`������i����8t��|AX��E��� ��L�CTd�$^p�k1�k�\䦿Km��J�:��]���.\;iu�F�H,�2fwd����������)���0'�^ ����n?������"ct��0�`��p��Nϛ�䁶!��=�*��a�8p !bf��鏜g^DxSgS���ʪ�?/��Py�NN���;��L?��� \m�@�qB2tI������� �[Y]Փ�V�.��z �Q����.�r�4Jg���֨�0��,o�O��$�;<�wE����Ѩ�~ P��Ձ� ��t���m��U0~�ݱ;ˮ'��w�"|ğ�l� z,A��*�y*fdP(9B��cT�#M�g�^½�ٶ��k���y� N�Q�eD���IFt$�}V�����ƌ�E�S '��E���G�f6'v�՜��-���������;!�a���cC^�A� ��D�-�ݣ��,P83���*f����?p����d���dګ�{6" �l�؎7~���XF��~cT4������ǃuF�ѫ�aOgGc��T���ٳ�]�rI��4��q{�q����糎F��#PX9JD���V>�Nr!���<����N�3���|�3n�k�e�f���C��KbaȚ.Np�/��2������!ftA��lI��x���wl��L��R�h>/���N�"h������ަ�/#��*xY"�$���L J��D���F'kY�+Bb�y�]d��4���~y�l�d6A:Ago:ֲR?`9N���=��'����r·�F�3ԴEK@T*ұ1U��[��R��Ё�P2y�%}��I将�]:\2Q��E��tF6$�W2�Z9q�G) 7�*F�P�g5*�)�Yp��m����a�ǏmP�,щ�����EeR��n,�"�y �� ��3Y���;�4��h� �5�ߥL�g*��~�X�X�}�mn�ޤ��!R���S<\@�̬�A��QЋ;����m�o�4j\3v�Έs�����rc�`��P���V��RW�p��R�"0<�xۄ� 庐l��@�D��d�r���F�8U���539�-�m{{��Ý�Hi��#c��m����d��~klQ�-�2�I�L��G��8�!�OT�#_���49����#��m!ԗ��[ٝ�_���Z�˗9K%����>V�`՝��P�u?[-ƀ�e�D �(ۅ��O�;Jʕ8��as����G��.����[}<Rl������3|B���&���$Y��{�S��2��_�Q�1q���A�,�B�މ�tVI�>�Ʀn(��*��O�f.rUC��E��op#��+�,x��Y/�ߧ!�6R��h�A/����Y,H�ﺀ�L�UߴTK��2=;uC n��]%G<i�0{�<>�L�;�+�h���4VV[���Њ甧�O��4v/���$�lR����0;��S�@URVٮYn�6=��I���`�@�u��������t�w��Ŏ����5�J�|�վK�����b-ހ�Ć��-u�6S�A��q��iw�è�'�`���\���J%��6Fn��?}~�%�t�/��I!6���U �1(Q@��w�h�}~,��E*V�W�[�Z��Ŀ�n�?��΅���v�H�Ұv�e�LU��[k��D�,��?�}\��Ř����֍л3v/���jZe2�%������^闻(;H����4�b�b�0��bx3��G��`�xN��>f.,\YӰ�F��mD� �ʕ}��Ǥ��VSo���.�&Kӫ�3�jS���X|�SyA��Sg�ę� �n���h#�B���r����H��c}�e���C��7}���U����U-4�Q�eyؓ�OF����I������(�������z�nlV\���LztS(����`sK�[ ����������"�1ySQ3�j�P�n&�c� 3P��s{���}U7�i���<���&L}٬��lF8<Z�;�!�(��5�{����$$*�S����O��`������L�,l�Z�؍p���HO�Z<�|��[J��GL=���p�����K�i�N�=[��������
Static task
static1
Behavioral task
behavioral1
Sample
AVA战神辅助 1.1.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
AVA战神辅助 1.1.exe
Resource
win10v2004-20241007-en
General
-
Target
2d38416c074d326ef4256cb62e26e16a_JaffaCakes118
-
Size
1.2MB
-
MD5
2d38416c074d326ef4256cb62e26e16a
-
SHA1
24e4b1c1bfddb6f284db72ac42bc24df39a2026c
-
SHA256
617f00dbbbfe7f27b6465da6698c5862ef67c76255ca8e140f45af2836d94ca4
-
SHA512
4831bf486feffa5580a6f1452acf085f2b16cf0a4b09a672e42d997bb8b3a99647583c40c43509a0e6863a4f1350b61ba56a2e60e8530d3e94317c515394b429
-
SSDEEP
24576:zBCGSQ0oeGmmiELI0WmrR2LSS9D5bWujWLsmeBEnChRCOVhL6vm0na4S:VClM/iELIf6R6t5bWujWw96sRzVhknK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/AVA战神辅助 1.1.exe
Files
-
2d38416c074d326ef4256cb62e26e16a_JaffaCakes118.rar
-
AVA战神辅助 1.1.exe.exe windows:4 windows x86 arch:x86
f796f5da9f9fa334e35713596390ac9a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
HttpQueryInfoA
user32
EndDialog
kernel32
RtlZeroMemory
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
shell32
SHBrowseForFolderA
advapi32
OpenProcessToken
ole32
CoGetMalloc
Exports
Exports
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 157KB - Virtual size: 857KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ava0 Size: - Virtual size: 434KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ava1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE