����#G��$wb���q7a�$@AW���g�=<��C �,/_�����j�۷e0�#�9!4":8�[���W>�g��b�D^3_��H[Z�J���0�q�M�z����'{�����6�hH�z�r2��7�<�)B]@�u�:��t�Y_T�TA n(Ƥ���7�k������7 ���綻��P�M�hC��kآ6�t�H�`@��S�,2���إ�ٍ|2�k�j�����o��7g3�����U������w��r)�f��Ӟ���G�����3�BdZ<*���r�r2&pϥ�_2�U:�5E-yՌ��g��rأ%�(��L���P,�EA�h��ҁa��K�o��4�.�,L佘����a�@�n�V�Ұ) :�pǿ�3�����^�A���o�?�k<Vt������H�������G�ў���)x�FH\�$��oP�I�r�Ǧ�� ϖX"�k*�tVZo�#�h2�agK�u��v����؏��w>�vS�����~��v^����4%{�VVD�wn����9 �R���6G�>����&6�;_�"]�d��t�m���ڱ)oH<���������>R�Μ�}٢4oQ�<��v8�!<�|�ț�q}W80H0����{��ڄ�զ�O;ܰ�]*��+Q";�-Q]L�!�0���/�U�Oڛo���Y�Q�dA�ت�۽i�"��K>� �O:Nm��.�`o���� G�������'��`���3��c�l�(�=���������eM.�8p��;�GҔA'��Ã?���~�,�K��DN�I�#*������W���a*{=ح���5�C��{ߺCt��4,�h����y��mz��Qկxc��Z%�!��+9���� �ъ�Ky]`�����i��� W���j$.��>��[���7����,�RG b��eǩ��T��2ĔE}������p��)2���J�Y�K�w�����j���� ���z�bMT���G�@�)�%i�-;\Ǵ(�����s D/�&hR���tB,`��� >u����d_�s{��+|�<��)ZxX�V��{h�0u0�D�m���V�2֓�1l7�^���A�piO|fZ�+���i��e4O^��\��}��HX�~���`>D ��I��U�\�oԉv�����G��������f$ב�Lu���q0G�N��$t4y�P��������rp�K�.�V���^���8g���@V�L���ŀLV��ALs�|6qǴk ���݅�B�v�1Ґ��e�3�i�]g/��|���PԌ�1;�� Ї�f�tH�<`���"����az�N�lӷ{M�^7qZ��H� �S���R=i���8���f:~�v�$"�ܱRX��B�K���j�m�y�#��'+=��Fخ[���7{}id�?g���jw���Y��@\�+J���T���E����h��}�dm(�����E�Bp@�K=��pR�o�m�D�}�^Q 0��ߴ�=���#�ϵ�Dz��j�U��1�os�C��� v�S�A��`�C��t���/&�VҿQ?����E]���ҒMɧ=�����Ձ��(���&�����p��Z��|�t��<��T�>���B?W��B�64B�B��sE�J1��+�I�M�d�B�������a�I���펫;�A6�1Cv�7�)��+�(�u�~2L7�{���"���O� (/���b����YB+WU��gfS2�nH�a�� `iA�Lq��vme�8�B�0��ݶv�7��G���Ǭ�s�o٠#j��ּJ�m6l-��<a5g� N<�X�ޖ�ځ3q�{�wc��Q0�����l������<:�L�������v:����6&��\��'�����}B�OB>��_Dk����.G>i �p�1�ܹ�r�ӵ\���K�W-�����c�$\pR%y+K��`؏�b=C�2��EL6OWN��Vz�n���G� �t;̼�����k%�*x�¸���6��@�ue�{ގ�GY��7Nx������ɯ�A��f_� �)d�������f� �Grg'��~�����1k��g���\x�/,R�7��iw�,@H�Ȩ��:43�v��ֽ�%�ļn��4�x�h*w��5,�pG��r����Hm�O�<A���+�n��!����;�1���xƺ��N1�[Hc7 ֗�#��s�z�Fwk��b/�)����xv ���8~�(=R��J��D���ZQ���]��ic����*>�v�$�MX�6ٝ� ��'T�*[e!X�v�W��l�Ê<�"��ރ�']c0"«x��>��Pϣ�*K0x;f��3����\�&Kf�[B�a���f��H�iu���˴a� ����d`��o+�����n9w��y�}]uL���j��H��Heg<�y�b�]��� �)�x0��=�܂�(w��U����C�o!9D��G��>!��A�<�2�"���v�a����]�{��AG��~�� z�G�.�@�����r�>�����c�T{�y3Y���>� Ex���(>2�q���9K)��:����.����;)A���=��v���>ړ�"�J�%`r���t�ݖ���D���{���[D*����5����A��?MxjO]�@c1#$�l���G������^��Yj��_~J�j���FF:�oqx��:�Q�P�f�u�u*�x���q�0��ȿ)A:��<6���I�%�uH�-���a.�fc{�_� _��k�Ej��z��Z��Q1������u�����J-K���i(5� a�!n�`����;���5��9�V)߰[�`GB�< �^�[�Hg�O�D���b�^��[Z���Kϗ�!U��>_dq�E��|U߰�Z�#y�`n�q����N{G�^�p���AV�_��� ��W�W�*:69��_��[��c.�uG�1� P 4")�&�˃ `�?���U2=3�pf?=��eq���el�l���������=���MEiA��j7WR�byX�-M���b�Uh��J���|�����O8Ho�ߢ�cK��@,URj�Ac�Ճǯ�M9�N��
Static task
static1
Behavioral task
behavioral1
Sample
KOAR+10Tr-LNG.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
KOAR+10Tr-LNG.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
游侠网专题导航-游侠网中国单机游戏门户.url
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
游侠网专题导航-游侠网中国单机游戏门户.url
Resource
win10v2004-20241007-en
General
-
Target
36a793e2def696ebbc046c150ecbb483_JaffaCakes118
-
Size
2.0MB
-
MD5
36a793e2def696ebbc046c150ecbb483
-
SHA1
34b6245038e8b6c6ad1604c9ccac66fdc22f98db
-
SHA256
abfced50bd7322c9cce694f4b46d58abf61ab37ff6dc12ec7edc94c545436df7
-
SHA512
e9595c6df1c6147851392a79495527ebedc08814b8d88473915e9cc43212e9fd48b15b99a2ce49e002e40a49c7b2a18e1728d00814a974399ac52e4c49e9cb9f
-
SSDEEP
49152:qGWBkI1M3Q7B4vyrYoBIeWr8zWOJh7G/Pem/3g:qGWBz7eS5q8zWOJZG/Pemo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/KOAR+10Tr-LNG.exe
Files
-
36a793e2def696ebbc046c150ecbb483_JaffaCakes118.rar
-
ALI213.txt
-
KOAR+10Tr-LNG.exe.exe windows:4 windows x86 arch:x86
2136d011919d3b0daae19639ec27d499
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaPrintFile
kernel32
ReadFile
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutReset
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
游侠网专题导航-游侠网中国单机游戏门户.url.url