�vA�ve���*س�a�qm��"^d�&�F�B}�0���J h�m�EѴ�Ι� -��/��;�V2����x*t���6\��q�|(�2yW���3����d�+5m��.��R���M��/��P�_�+f�o)������)t� 0S}"��!%H������.�`�i��2T�b��ƞ�E9�_����FJ=�ϛ��p>Gx��)�*�K�Ϩ =�SE�"lP�8R��)�h�7���m;���������4�܆��{$0��?����t��,�ל�ԍ[��L�R����5`����B������;7���c��BG2;���X'<���5�� ��y���_��ti��SD?�B�V��6"�����K�"HvvF���&�B�����4e��W�y3̅En��ya���*�s���{�-�C��B�g�zs�.1\~Z��� ��=���=�a�E�R˽3�:�&����BY��� 4�H�����������L6�.Liޣyķ����f��;��]E�Qe�^��*J�]�#�3 E sHF���,'�&�(n�m�Dw�3�:5"b���P�m8��&�^���B�����+��(��n[�eݿ6/8v�.�DEj�2S�D�ؖ+]{=ޟ-���D�!�o�"��/㐇��!�T��Q���φ,92{'N��� ,�>t��T��K������l�o_��lK��c=r��%�,���5#V�|pMQ�:]�U�55h3�ą^���r�����>�g��i�a���A@ ��fB��P�H�4���H�E.&�>w�c#N�@Y��d�k�����f��(h� �F�K�k�%��`�F�>�^.1�C=��)�h��X�N�N��3�F#�h���� ��hf�E�4B����5���sMi$ePô�X��8������-�J�eY,6MEj$�m�K�б8dB�;��H������sW�eZ�����Mlk��Z1�dt�Z�����~X�`�MEn@�S�w�'��w��@��R�D<Z���������]Q���Z�T�����l<�B)s�1���MP����@�6ک�oE�������]�Z�L���ח��uB��������G�<�>����Po+�j���W��Z>�U�&DU��ݚ��s�Y�6���+_��3u6���W���I*��xsN����8���\J��?�� ��Gtߠ��X����n��Z�F��*��g^~.��{{`c�BL�,I�� ��R7��@B��*��^�B�2����2 QW���L9}�|���k��v���#���K ���[���: %\w.�,�� mA������x�� ���.�n͍%�c�̠Dk����t�K��0���X�Ť���m -̼y26�U6.����_����=�T�����3��s5=������i%�KE�)5�2 ���Aq�Dd�@����x���X�B���i��+�3������W&"&���#\����p���>��s�C������������,E� ����t<:0�!��V��˃:R�LXКwCl[/��G�b���Ap����?"0��DČ��Z��^k����E+@Na���>�ͶS0�aõ��nt�[� EqɑR��|�� Ѕ$ǪQ�����ԓ��y�f��|H=��0.������fI�:QѴ'���������`[��R��7�)�T`���ߟ���}����,�0���l�4��箵�3��� �T���l��e�M:�4*짇�FJMZ���d�,cH$���#����]�� �RQ�v�,�Z[��R����W糤-�@7�s���D���@e����X�cq4#�O��t�3� h5C�oD ��l�@���.���j���0}��F}y}y>!�cݾ��pД�BG{9�n�6rD�+S�^'���(�ԫy�侞�cZ�Y>�t�Sr����ɿۿ����-L@�uCӎD��} 2�S���?���bS���؍�(㶟�9���?v�$�H^�lLᱚ��xJ��y���?g��z_����˒fhA9�ڄ�$/(7���d��OɎ���+�g�aہ��H�b���#ޣ��S�r���`|�:s�g?2�����Ɗ4_*ֵS�� �I�H�7�[��X �xl;��Z��Mہ[4!E��_a}�e��]y?�I��@�+��]�O���^N���O����� b����n�=�T��H�Z�?�o�'�n=����M�C�9�S�a��@�g.1��%c����(5?Z|y=��ٗ&�'���'����,�N�ٜ5֖���]!k6�K�D�'M O���+6:L�h�����]�H��w��S�s��q��� rd�r�S���=�W��©�4�ʰl������H�K���p�\>����RBl�0����,�}��2�����Qp"��ly��_�:�Vk�D��PDw�L����՟u|��fu�d���zIJEbt�,Jih��(��x>���m���|��,�_�r�x��j��Ϋ�x�fw��o��O!,�[�vL¨�y �h�4���ٯ�h}��MuWg���o�EMcW/c� �W�W �U+q�a�q�ƃW�r���_ ع3o�r,+4��ׯ���ک�����Y�z㔋lzm�,<�����&Z��ʗhڈ�� 9.K�_�bH�V1Ѕgl�����"�i@�F�W!�ܦ��L�@�N����t0[�g�c�P��ѓ�+�-w�sc�����w�����%�W����kh�� �Ds[!�_rU��`�����$Ez��f���"!<"��Q�f���H�ˣ(�2�����/Y���t������ �W�]��lޟ���ԁ�h�d�Ϣ�o�'�� �'�,>*�0�N���Q'� <F�N�x�h���ػ�����Jp툝L��c��`HA��s���@�8�S�^�^� �a���������U�$�A����ˍ��퍑X ��%����F��w�#f>�>R�-�~M�1�����r�>M�a��B��' JB��Q��o��W�H�*�.2�>�����l4���j1"�~���V$�,��-���
Static task
static1
Behavioral task
behavioral1
Sample
HitAbsolution/HitAbsolution+2Tr-LNG.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
HitAbsolution/HitAbsolution+2Tr-LNG.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
HitAbsolution/xpϵͳ֮.url
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
HitAbsolution/xpϵͳ֮.url
Resource
win10v2004-20241007-en
General
-
Target
3eb7f4c09f2847b8032944dd29d0bbe2_JaffaCakes118
-
Size
2.2MB
-
MD5
3eb7f4c09f2847b8032944dd29d0bbe2
-
SHA1
190bc3e9ba772f90b19a6c0cc99816cd1875fc81
-
SHA256
aa8f1572b89a336ed513b0817bfd33d4247cbf053d15923205c5556505956d8d
-
SHA512
19b871cd7bce9ca78cbce6631cc1af56d15f193ef3bb9fac0a8f7baaf932edc22d617c9495e5cbbb65edffed352064f384cdb2c54c5911eb7246e98199302ae0
-
SSDEEP
49152:vv2rhvOrxF7aAFcnI7BM/42Rhcun14lOSgF7hp1bQ5inbD0Ji1GTl49:Wrhvm77aKIaay04lOSy7hpmibuiYO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/HitAbsolution/HitAbsolution+2Tr-LNG.exe
Files
-
3eb7f4c09f2847b8032944dd29d0bbe2_JaffaCakes118.zip
-
HitAbsolution/HitAbsolution+2Tr-LNG - I.N.F.O.txt
-
HitAbsolution/HitAbsolution+2Tr-LNG.exe.exe windows:4 windows x86 arch:x86
7a347341941c225f620272a35a1acf1d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaFpR4
kernel32
CloseHandle
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutClose
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
HitAbsolution/VERY IMPORTANT!.txt
-
HitAbsolution/xpϵͳ֮.url.url
-
HitAbsolution/ʹ˵.txt