�EG�T٬�lCDg�~KY��� ���ud��v�3�T�t���:�0T����b��ڡ�F��7{qjT5��4���=���r���� �DŽ����d�)%����n�@_�Oh���K�e��<�����G�Hh��L�l<�w*�\L�@HzTRJ�����{��ؖN4�S),Y��_zo 5x������V���ĩ�� 0���o�ЬyM����*e�t�x#�k*Uw���t=���O]�~/��>�a\�$����1B:I��Tӳ��0���!/��&�1 8E{������h�Z.�u�)�2�~��M�+D�H�0�uˈcJ�B��n8�*b:��q�rЯ�:V���ކ}�! k����4��<9����1:�@f�`�����5l�T�"Wf� ��BxT]]丈#�vc�Y^��qe蠐�*�6[�u����a XB;�ҵp+�d�����ש>��:�_y/�o[~�h�F��9:l�K= �^9<ݰ]����ۉ�;�rb��?��;�B�)hqZ����}:����n�c��w"~M�Gozu?g#b[�����8�L���YW��I�VL/J�Վ�����:���~W���و����)���]����'o9�T~CΡ%����J1`J�ʉ��w8�8d����Q[�V�<�-���J%�]��·�Uu8���g�Iĸ������)Di���^Q���r)T�[Am�*h�� ���6�%r�9� p��_�5)�6FtplH�G���XdD,2X%g��s@�e��(6��0@��ᗨf�hBZj��}��R�f��<X�5�9��K�R8X�c���n��4v�����̵F��O�$�7�z�F9��ȽNstX��c�^�A���Vu��}-\�hv�K����{^c�T�@��\����H5�@�F˳��v��ˆ,�m��VH�o���]�W �^uA ~l��x���W/22�a9B!��(�tWß�!VvPa��W��2 `�.�|�Q��si7�.�����?��BZ�&����s�Ϟ=��_c3~Y�Z�a%ˈ�S��� �&�JV������cUe�8�:����r\;5]�½h�,�ֻ����U�+�z(��ޟ�t�������4|U�W�SH�[�`$��B��T�Q��^����cڈ�b�LMe����o �B�6����|3�b�Q�o���e�ʐ��B�Fe/�����?�f�|�������R&{�E�4|�d�Eyl�7$��� ��B��O��Ȕ����������]b����!Z��p�W���8�e�����s��Fs��b�N"����0���K�Kb �z}I�&�t w:#�`��E���������w�f�JW �?��"�&��]�~~�+ t�R�~�M�e�i��\����~�'�� �Z+rJ-�Qi�#�UE ��~�q�8�o���(me�=��ecM���`���z�5c����H����ݼ�K�D�l��9�� ���G���?�&g�g"�ْn<�@:uE��8����05�'Y\+��[V�f�.�t�{^D@���"��}k�-$�b�x��-X�A�kNY�O�rlP64���\6�o�$Ё� ćԌ�X�ey`'��t��|�ہl����U������\m���`1Q&�VĬ�#����lcC�q��o���aXV:���r1���#ܺ�"�Vi�g��H͊�a�9�<���:@7�� j��o�YHF,�lpFL��Bě�=�w�,�O�ln)�7�+v�[�Ἇ��$��)�SE�'� U�@O�G�� �|��du= �Ô%8�ѓ��L�ՊMM9̼ж<;����o��e&�0�W���T�_۷e��S) ����p�&��Ŧ;V����<l�/7Y*�i�*S�����f1"�&�V�*H��(c㉗� '��U�iH�� �@4���~�I�A��i?��O�~J�DZ��՚&��+b`����P����Ad`8�r�Q;#���44���ZŜ]+K)~q�5���{�*y�X��%G��y>{��2}�s���q����� �d;x�Ҵ�z��}1�Q�$Y=�e�;j^v�a�O�jZ�_=q]����/�b�p��{�6��Ϟ���V�p��}��Dl.�|�N����OsyD(��T�*�B����~� C�u�J�ۇϩmUr�~��n�@���#�ǾN?�q�6��}��@�!KWż�������?�S�[sE\_��4�:Tľq�b�KÛ�;H+��j�D6�Tk,݈�f:�vs��Ue,�e9��D�U2�����m�n��f��D�?9��Fq|�M�{@� ��X��Y���d�bI38��e �6�-c7��p��V���� D. KTo*���oE���W7@�@��2�I����*dq ��|a��*+T���/��UQ�2*Ou�T��dG ���QB0�k�Fł��!�z�m�%W ���v�8�,)��9�}���'v[T�*�ë��JՒ5�~9}k��=�|L� ϴs�������Ҙ��F���m l,��*����Zh�/���9����0I�~1��c4��X3tpE�Y}ͦF' �6X)�G��G!0/*#��q��G�r��3A>Y���0�GA���Q6D��C2�[�/:����*��&\� ,�����k�kМm�S4��JL���I��r��u�~��<�wWG�#O�;���;��5K�����:��ʱ~�J�h�M�X��އ�\��A>� E|"�e��B� �l�3;�[n� 꿑���6�YC1�e\�B�m� ~�sKX��E^A�fi1��_�n�Κ��3��+����׆:@o*ǃ�t��R���*���,ٸ��A����; 0�b�&v=�*�П͖�jנ_�0)�܍W��3A����� �g�β���Ը�����#��Oo��y�U�G ��9bd<Ð���O�*�1z�>�`P�9{���]�]���a��dS~��$���7�?��*���s����r���m؆ �L��ymj�]��Ű��P��b�Zr˜�ܡ�K����CӦG4���@��P3�q�+��"9�����˩ ���䪃@�Th'EX���f�o�B��l47�7�U�OĀT�,L��`-1�L^Kn��
Static task
static1
Behavioral task
behavioral1
Sample
TraFOC+16Tr-LNG.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
TraFOC+16Tr-LNG.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
游侠网专题导航-游侠网中国单机游戏门户.url
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
游侠网专题导航-游侠网中国单机游戏门户.url
Resource
win10v2004-20241007-en
General
-
Target
2e5b8569ee7ea0ef88916bff436798cd_JaffaCakes118
-
Size
2.2MB
-
MD5
2e5b8569ee7ea0ef88916bff436798cd
-
SHA1
20391c3a14a11488d221646c1313a4b653311958
-
SHA256
acd3e601505eaa2752411e563d16d0991d06d2b24bbec8571db9be453d7ddace
-
SHA512
3dffa32fbe7c927e4917028c1555ef725c4737078b6dac902f5e10257513e50a5280b61c867fa172f4cf54be8059ee2c5fe4fb4156a3392e4eb54923b3a2e0eb
-
SSDEEP
49152:L60Hg5h/znXXOEo4Vdh2JhMVTbc61ujhNAJJZqs0SazXuRKUtrD8W333ZP2:W0Hg7LnXeEVVd8rMzujzAJJZv80NtEMk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/TraFOC+16Tr-LNG.exe
Files
-
2e5b8569ee7ea0ef88916bff436798cd_JaffaCakes118.rar
-
ALI213.txt
-
TraFOC+16Tr-LNG - I.N.F.O.txt
-
TraFOC+16Tr-LNG.exe.exe windows:4 windows x86 arch:x86
a38120f108506456e75c29d3b2b4fb2f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaI4Str
kernel32
CreateFileA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutWrite
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
VERY IMPORTANT!.txt
-
游侠网专题导航-游侠网中国单机游戏门户.url.url